# VMware Fusion vulnerabilities Source: https://junglewise.ai/threats/technologies/fusion Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/fusion.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 8 vulnerabilities in VMware Fusion: 0 in the last 7 days and 2 in the last 90 days, 5 of them critical and 4 exploited in the wild. The most recent, CVE-2026-59347, was published on 7 October 2026. Nothing in the last four weeks, down from 2 vulnerabilities in the four before. 0 critical against 1. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 2 - All time: 8 (5 critical, 4 exploited in the wild) ## About VMware Fusion VMware hypervisor software for running virtual machines on x86 processors. ## Latest VMware Fusion vulnerabilities - [CVE-2026-59347: VMware Workstation and Fusion stack buffer overflow in HGFS](https://junglewise.ai/threats/cve-2026-59347-vmware-workstation-and-fusion-contain-a-stack-based-buffer) (high, CVSS 8.1, published 7 Oct 2026) - [CVE-2026-59346: VMware Workstation and Fusion integer overflow in VMXNET3](https://junglewise.ai/threats/cve-2026-59346-vmware-workstation-and-fusion-contain-an-integer-overflow) (critical, CVSS 9.3, published 7 Oct 2026) - [CVE-2026-41703: VMware ESXi, Workstation, and Fusion out-of-bounds read](https://junglewise.ai/threats/cve-2026-41703-vmware-esxi-workstation-and-fusion-out-of-bounds-read) (high, CVSS 7.6, published 30 Jul 2026) - [CVE-2026-41702: VMware Fusion privilege escalation via TOCTOU in SETUID binary](https://junglewise.ai/threats/cve-2026-41702-vmware-fusion-privilege-escalation-via-toctou-in-setuid-binary) (high, CVSS 7.8, published 15 May 2026) - [CVE-2025-22226: VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability](https://junglewise.ai/threats/cve-2025-22226-vmware-esxi-workstation-and-fusion-information-disclosure) (critical, exploited in the wild, CVSS 7.1, published 4 Mar 2025) - [CVE-2025-22225: VMware ESXi Arbitrary Write Vulnerability](https://junglewise.ai/threats/cve-2025-22225-vmware-esxi-arbitrary-write-vulnerability) (critical, exploited in the wild, CVSS 8.2, published 4 Mar 2025) - [CVE-2024-37085: VMware ESXi Authentication Bypass Vulnerability](https://junglewise.ai/threats/cve-2024-37085-vmware-esxi-authentication-bypass-vulnerability) (critical, exploited in the wild, CVSS 7.2, published 30 Jul 2024) - [CVE-2020-3950: VMware Multiple Products Privilege Escalation Vulnerability](https://junglewise.ai/threats/cve-2020-3950-vmware-multiple-products-privilege-escalation-vulnerability) (critical, exploited in the wild, CVSS 7.8, published 3 Nov 2021) ## Most severe VMware Fusion vulnerabilities - [CVE-2025-22225: VMware ESXi Arbitrary Write Vulnerability](https://junglewise.ai/threats/cve-2025-22225-vmware-esxi-arbitrary-write-vulnerability) (critical, exploited in the wild, CVSS 8.2, published 4 Mar 2025) - [CVE-2020-3950: VMware Multiple Products Privilege Escalation Vulnerability](https://junglewise.ai/threats/cve-2020-3950-vmware-multiple-products-privilege-escalation-vulnerability) (critical, exploited in the wild, CVSS 7.8, published 3 Nov 2021) - [CVE-2024-37085: VMware ESXi Authentication Bypass Vulnerability](https://junglewise.ai/threats/cve-2024-37085-vmware-esxi-authentication-bypass-vulnerability) (critical, exploited in the wild, CVSS 7.2, published 30 Jul 2024) - [CVE-2025-22226: VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability](https://junglewise.ai/threats/cve-2025-22226-vmware-esxi-workstation-and-fusion-information-disclosure) (critical, exploited in the wild, CVSS 7.1, published 4 Mar 2025) - [CVE-2026-59346: VMware Workstation and Fusion integer overflow in VMXNET3](https://junglewise.ai/threats/cve-2026-59346-vmware-workstation-and-fusion-contain-an-integer-overflow) (critical, CVSS 9.3, published 7 Oct 2026) - [CVE-2026-59347: VMware Workstation and Fusion stack buffer overflow in HGFS](https://junglewise.ai/threats/cve-2026-59347-vmware-workstation-and-fusion-contain-a-stack-based-buffer) (high, CVSS 8.1, published 7 Oct 2026) - [CVE-2026-41702: VMware Fusion privilege escalation via TOCTOU in SETUID binary](https://junglewise.ai/threats/cve-2026-41702-vmware-fusion-privilege-escalation-via-toctou-in-setuid-binary) (high, CVSS 7.8, published 15 May 2026) - [CVE-2026-41703: VMware ESXi, Workstation, and Fusion out-of-bounds read](https://junglewise.ai/threats/cve-2026-41703-vmware-esxi-workstation-and-fusion-out-of-bounds-read) (high, CVSS 7.6, published 30 Jul 2026) ## Vulnerabilities per week Nothing in the last four weeks, down from 2 vulnerabilities in the four before. 0 critical against 1. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 2 | 1 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other VMware technologies - [VMware RabbitMQ](https://junglewise.ai/threats/technologies/vmware-rabbitmq): 30 vulnerabilities - [VMware Spring Framework](https://junglewise.ai/threats/technologies/spring-framework): 26 vulnerabilities - [VMware Cloud Foundation](https://junglewise.ai/threats/technologies/cloud-foundation): 21 vulnerabilities - [VMware Spring AI](https://junglewise.ai/threats/technologies/spring-ai): 20 vulnerabilities - [VMware Spring Security](https://junglewise.ai/threats/technologies/spring-security): 19 vulnerabilities - [VMware ESXi](https://junglewise.ai/threats/technologies/esxi): 11 vulnerabilities - [VMware Spring Boot](https://junglewise.ai/threats/technologies/spring-boot): 11 vulnerabilities - [VMware Avi Load Balancer](https://junglewise.ai/threats/technologies/avi-load-balancer): 7 vulnerabilities - [VMware Spring for GraphQL](https://junglewise.ai/threats/technologies/spring-for-graphql): 7 vulnerabilities - [VMware Spring Integration](https://junglewise.ai/threats/technologies/spring-integration): 7 vulnerabilities - [VMware vSphere Foundation](https://junglewise.ai/threats/technologies/vsphere-foundation): 7 vulnerabilities - [VMware Spring Web Services](https://junglewise.ai/threats/technologies/web-services): 7 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "VMware Fusion vulnerabilities", https://junglewise.ai/threats/technologies/fusion, 9 November 2026.