CVE-2026-47876
Received Received - Intake

VMXNET3 Out-of-Bounds Write in VMware ESXi

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: VMware

Description
VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Non VMXNET3 virtual adapters are not affected by this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-30
Last Modified
2026-07-30
Generated
2026-07-30
AI Q&A
2026-07-30
EPSS Evaluated
N/A
NVD
CVE-2026-47876
EUVD
EUVD-2026-51105

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vmware esx *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an out-of-bounds write flaw in VMware ESX's VMXNET3 virtual network adapter. It allows a local admin on a VM with this adapter to execute code on the host system.

Detection Guidance

Detection requires checking for VMXNET3 virtual network adapters on VMware ESX hosts. Inspect virtual machine configurations for VMXNET3 adapters using VMware tools or commands like 'esxcli network nic list' on ESX hosts. Ensure no unauthorized modifications exist.

Impact Analysis

If exploited, it could let an attacker with local admin rights on a VM gain control of the host system, potentially compromising all VMs and data on that host.

Mitigation Strategies

Apply VMware's official patch or update for ESX. If patching is delayed, restrict local administrative privileges on virtual machines using VMXNET3 adapters. Monitor for unusual activity and isolate affected systems until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47876. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart