VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability. A malicious actor with VM deployment privileges could trigger an out-of-bounds read, potentially leading to information disclosure or more likely a Denial-of-Service (DoS) condition of the host process. On Workstation and Fusion, the impact of this vulnerability is restricted to information disclosure.

vmware VMSA-2026-0006: VMware ESX, vCenter, Workstation, and Fusion updates address multiple vulnerabilities (CVE-2026-59309, CVE-2026-59310, CVE-2026-47876, CVE-2026-41703, CVE-2026-41709)

The version of VMware ESX installed on the remote host is 8.0 prior to build 25205845 (8.0 Update 3i), or 9.0 prior to build 25595025 (9.0.2.0100), or 9.1 prior to build 25370933 (9.1.0.0). It is, therefore, affected by a vulnerability as referenced in the VMSA-2026-0006.1 advisory:

  - VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability. A malicious actor     with VM deployment privileges could trigger an out-of-bounds read, potentially leading to information     disclosure or more likely a Denial-of-Service (DoS) condition of the host process. On Workstation and     Fusion, the impact of this vulnerability is restricted to information disclosure. (CVE-2026-41703)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of VMware Fusion installed on the remote macOS host is 25.x (25H2) prior to 26.0.0 (26H1). It is, therefore, affected by a vulnerability as referenced in the VMSA-2026-0006.1 advisory:

  - VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability. A malicious actor     with VM deployment privileges could trigger an out-of-bounds read, potentially leading to information     disclosure or more likely a Denial-of-Service (DoS) condition of the host process. On Workstation and     Fusion, the impact of this vulnerability is restricted to information disclosure. (CVE-2026-41703)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of VMware Workstation installed on the remote host is 25.x (25H2) prior to 26.0.0 (26H1). It is, therefore, affected by a vulnerability.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
337682	VMware ESX 8.0 / 9.0 / 9.1 Out-of-Bounds Read (VMSA-2026-0006)	Nessus	Misc.	Remote	high
337681	VMware Fusion 25.x < 26.0.0 Information Disclosure (VMSA-2026-0006)	Nessus	MacOS X Local Security Checks	Local	high
330656	VMware Workstation 25.x < 26.0.0 Vulnerability (VMSA-2026-0006)	Nessus	General	Local	high

Detections

Analytics

CVE-2026-41703

high

Tenable Plugins

Coming Soon

high

high

high