What is the CVSS score of EUVD-2026-51105?

EUVD-2026-51105 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of VMware ESX are affected by EUVD-2026-51105?

VMware hypervisor platforms (ESX, vSphere, Cloud Foundation, Telco Cloud Platform) face a critical vulnerability enabling complete infrastructure compromise when attackers gain administrative access…

How to fix or mitigate EUVD-2026-51105?

Within 24 hours: Conduct an immediate asset inventory to identify all virtual machines configured with VMXNET3 adapters across your VMware estate, map which VMs operate with administrative privileges or host critical business functions, and implement network segmentation to restrict traffic from VMXNET3-equipped systems to management interfaces and sensitive infrastructure. Within 7 days: Deploy enhanced hypervisor logging and monitoring for memory-access anomalies and VMXNET3 driver activity patterns, establish formal incident response procedures for suspected host-level compromise scenarios, and enforce administrative access controls limiting VM admin privileges to essential personnel with documented justification. Within 30 days: Execute a phased migration strategy to transition production VMXNET3-configured virtual machines to alternative virtual network adapter types (E1000, SR-IOV, or PVRDMA based on workload requirements), prioritizing machines with elevated privilege levels or access to sensitive data systems.

VMware ESX EUVD-2026-51105

| CVE-2026-47876 CRITICAL

Out-of-bounds Write (CWE-787)

2026-07-30 vmware

GHSA-8f48-75j5-mrf7

Buffer Overflow Memory Corruption VMware Cloud Foundation Telco Cloud Platform Esx Vsphere Foundation

9.3

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

9.3 CRITICAL

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

vuln.today AI

8.2 HIGH

Description requires local administrative privileges inside the guest (PR:H) via a local vector (AV:L); the guest-to-host escape is a scope change (S:C) with full host C/I/A impact.

3.1 AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (vmware).

CVSS VectorVendor: vmware

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 13:23 vuln.today

CVE Published

Jul 30, 2026 - 12:31 cve.org

CRITICAL 9.3

DescriptionCVE.org

VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Non VMXNET3 virtual adapters are not affected by this issue.

Articles & Coverage 2

News 4 New VMware Vulnerabilities - 3 Critical, 1 High Severity Jul 31, 2026 News Critical Guest-to-Host Escape in VMware ESXi VMXNET3 - CVE-2026-47876 Jul 30, 2026

AnalysisAI

Guest-to-host escape in VMware ESX (and the ESX component of Cloud Foundation, vSphere Foundation, and Telco Cloud Platform) lets an attacker with administrative privileges inside a virtual machine execute code on the underlying hypervisor host via an out-of-bounds write in the VMXNET3 virtual network adapter. Only VMs configured with the VMXNET3 adapter are affected; other virtual NIC types are not. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor-issued Broadcom/VMware advisory and the CVSS 9.3 score reflect a critical host-compromise impact.

Technical ContextAI

VMXNET3 is VMware's paravirtualized 10GbE network adapter, implemented in the hypervisor's device-emulation layer (the per-VM VMX/VMM process on ESX). Guest driver operations against the emulated device cross the guest/host trust boundary, and CWE-787 (Out-of-bounds Write) indicates the host-side emulation code writes past the bounds of an allocated buffer when handling attacker-controlled input from the guest - typically malformed descriptor rings, packet metadata, or control-register values. Because the writable memory belongs to the host process rather than the guest, a successful write corrupts hypervisor memory and can be leveraged to run code in the host context, breaking VM isolation. The CPE set (cpe:2.3:a:vmware:esx, cloud_foundation, vsphere_foundation, telco_cloud_platform) shows the flaw is in the shared ESX virtualization stack that these platforms bundle.

RemediationAI

Apply the fixed ESX build as directed by the Broadcom/VMware security advisory at https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017; an exact patched version was not present in the provided data, so treat patch status as 'patch available per vendor advisory' and confirm the precise build number and applicable updates for Cloud Foundation, vSphere Foundation, ESX, and Telco Cloud Platform directly from that advisory. As a targeted compensating control where patching must be deferred, reconfigure sensitive or untrusted VMs to use a non-VMXNET3 network adapter (e.g. E1000e), which removes the vulnerable code path entirely at the cost of losing VMXNET3's paravirtualized performance and features and requiring a guest reconfiguration/driver change and VM restart. Additionally, tighten who holds administrative access inside guest VMs and isolate untrusted or multi-tenant workloads on dedicated hosts to reduce the blast radius of a successful escape until the patch is deployed.