SecBoard
Zurück zur CVE-Übersicht

CVE-2026-59346

CRITICAL(9.3)

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Risk Signal Score23/100 — NIEDRIG
  • CVSS 9.3 — Kritisch

EPSS-Score

0.4%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

9.3

Technische Schwere

Beschreibung

VMware Workstation and Fusion contain an integer-overflow vulnerability. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Affected versions: - VMware Workstation: 25H2, 26H1 (fixed in 26H1u1) - VMware Fusion: 25H2, 26H1 (fixed in 26H1u1)

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • VMware Workstation 26H1u1
  • VMware Fusion 26H1u1

Threat-Hunting-Queries

Detection for local administrative privilege escalation within a VM leading to host code execution. Focus on unusual process creation or network adapter manipulation from within the VM that impacts the host.

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessCommandLine contains "VMXNET3" and InitiatingProcessParentFileName contains "vmware-vmx.exe"
| where ProcessCommandLine contains "powershell" or ProcessCommandLine contains "cmd" or ProcessCommandLine contains "sh"
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName

Splunk SPL

index=* sourcetype=vmware:event (InitiatingProcessCommandLine="*VMXNET3*" AND InitiatingProcessParentFileName="vmware-vmx.exe") (ProcessCommandLine="*powershell*" OR ProcessCommandLine="*cmd*" OR ProcessCommandLine="*sh*")
| table _time, host, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName

Sigma

title: VMware VMXNET3 Integer Overflow Exploitation Attempt
status: experimental
description: Detects potential exploitation attempts of CVE-2026-59346 in VMware Workstation/Fusion by monitoring unusual process activity related to VMXNET3 from within a VM impacting the host.
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\vmware-vmx.exe'
    CommandLine|contains: 'VMXNET3'
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\bash.exe'
      - '\sh.exe'
  condition: selection

Elastic ES|QL

from process where event.type == "start" and process.parent.executable == "vmware-vmx.exe" and process.command_line : "*VMXNET3*" and (process.executable : "*powershell.exe" or process.executable : "*cmd.exe" or process.executable : "*sh.exe")
| select @timestamp, host.name, process.parent.executable, process.parent.command_line, process.executable, process.command_line, user.name

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen