CVE-2026-59346: Critical VMware Workstation & Fusion VM Escape — Detection and Remediation Guide

---
title: VMware vmware-vmx Spawning Shell or Script Interpreter - Possible VM Escape
description: Detects vmware-vmx.exe spawning command shells, script interpreters, or LOLBins. The virtual machine monitor process should never spawn interactive tooling; this is a high-fidelity indicator of guest-to-host escape (e.g., CVE-2026-59346 exploitation) achieving code execution on the host.
references:
  - https://thehackernews.com/2026/09/critical-vmware-workstation-and-fusion.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/09/10
status: experimental
id: 4f7c2a91-3b8d-4e56-a921-7d5e0c6b1f34
tags:
  - attack.execution
  - attack.t1059
  - attack.privilege_escalation
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\vmware-vmx.exe'
      - '\vmware-authd.exe'
      - '\vmware-hostd.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\wmic.exe'
      - '\curl.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Extremely rare. Legitimate VMware tools operations execute inside the guest, not as children of the host vmx process.
level: critical
---
title: VMware vmware-vmx Writing Executable Content to Host File System
description: Detects the vmware-vmx.exe process dropping executable or script files to user-writable host locations (Temp, AppData, ProgramData, Public). Post-escape payload staging frequently originates from the compromised vmx process context.
references:
  - https://thehackernews.com/2026/09/critical-vmware-workstation-and-fusion.html
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/09/10
status: experimental
id: 8a1e5d37-9c42-4f7b-b3e6-2c9a4d8e5f61
tags:
  - attack.execution
  - attack.t1105
logsource:
  category: file_event
  product: windows
detection:
  selection_image:
    Image|endswith: '\vmware-vmx.exe'
  selection_path:
    TargetFilename|contains:
      - '\AppData\'
      - '\Temp\'
      - '\ProgramData\'
      - '\Users\Public\'
  selection_ext:
    TargetFilename|endswith:
      - '.exe'
      - '.dll'
      - '.ps1'
      - '.bat'
      - '.cmd'
      - '.vbs'
      - '.js'
  condition: selection_image and selection_path and selection_ext
falsepositives:
  - VMware logging writes text logs to user directories; the extension filter excludes these.
  - Rare VMware tooling self-update components writing DLLs — validate against known VMware signed paths.
level: high
---
title: VMware Workstation or Fusion Hypervisor Process Crash Artifacts
description: Detects Windows Error Reporting artifacts and crash dumps for vmware-vmx.exe. Repeated or clustered vmx crashes may indicate exploitation attempts against memory-corruption flaws such as CVE-2026-59346 integer overflow, including failed exploit attempts.
references:
  - https://thehackernews.com/2026/09/critical-vmware-workstation-and-fusion.html
author: Security Arsenal
date: 2026/09/10
status: experimental
id: 2b6d9f14-7e38-4a1c-95d2-6f3b8a0c4e27
tags:
  - attack.exploitation
  - attack.t1068
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\WerFault.exe'
      - '\wermgr.exe'
    CommandLine|contains:
      - 'vmware-vmx'
  condition: selection
falsepositives:
  - Legitimate vmx instability from driver conflicts or resource exhaustion. Investigate clustered occurrences on the same host.
level: medium

// Hunt: VM escape indicator — VMware hypervisor processes spawning unexpected children (CVE-2026-59346 post-exploitation)
let VMwareHostProcs = dynamic(["vmware-vmx.exe", "vmware-authd.exe", "vmware-hostd.exe", "vmware-vmx-debug.exe"]);
let SuspiciousChildren = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "wmic.exe", "curl.exe", "net.exe", "whoami.exe", "ipconfig.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ (VMwareHostProcs)
| where FileName in~ (SuspiciousChildren)
| project TimeGenerated, DeviceName, AccountName = InitiatingProcessAccountName,
    HypervisorProcess = InitiatingProcessFileName, InitiatingProcessCommandLine,
    SpawnedProcess = FileName, ProcessCommandLine, SHA256, FolderPath
| sort by TimeGenerated desc
// Correlate with vmx crash events (possible failed exploit attempts)
;
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName in~ ("WerFault.exe", "wermgr.exe")
| where ProcessCommandLine has "vmware-vmx"
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessAccountName

// Linux hosts: vmware-vmx spawning shells/downloaders — ingested via Syslog/CEF
Syslog
| where TimeGenerated > ago(14d)
| where ProcessName =~ "vmware-vmx"
| where SyslogMessage has_any ("/bin/sh", "/bin/bash", "curl ", "wget ", "nc ", "python", "perl")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| sort by TimeGenerated desc

-- Hunt for VMware vmware-vmx processes with suspicious child processes
-- Indicator of guest-to-host escape exploitation (CVE-2026-59346 post-exploitation)
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Ppid IN (
    SELECT Pid FROM pslist()
    WHERE Name =~ 'vmware-vmx|vmware-authd|vmware-hostd'
)
AND Name =~ 'cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|certutil|bitsadmin|wmic|curl'

-- Inventory installed VMware Workstation versions for patch-gap assessment
SELECT Name, Version, InstallLocation, Publisher
FROM artifact.Windows.Registry.Installation()
WHERE Name =~ 'VMware Workstation'

# CVE-2026-59346 - VMware Workstation inventory and patch verification
# Run as Administrator. Deploy via RMM/Intune/SCCM for fleet coverage.

$results = @()

# 1. Locate installed VMware products via registry uninstall keys
$uninstallPaths = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
)
$vmware = Get-ItemProperty $uninstallPaths -ErrorAction SilentlyContinue |
    Where-Object { $_.DisplayName -match 'VMware Workstation' }

foreach ($app in $vmware) {
    $results += [PSCustomObject]@{
        Product      = $app.DisplayName
        Version      = $app.DisplayVersion
        Publisher    = $app.Publisher
        InstallDate  = $app.InstallDate
        Host         = $env:COMPUTERNAME
    }
}

# 2. Check file version of the vmware-vmx.exe binary directly
$vmxPath = "$env:ProgramFiles(x86)\VMware\VMware Workstation\vmware-vmx.exe"
if (-not (Test-Path $vmxPath)) {
    $vmxPath = "$env:ProgramFiles\VMware\VMware Workstation\x64\vmware-vmx.exe"
}
if (Test-Path $vmxPath) {
    $fileVer = (Get-Item $vmxPath).VersionInfo
    $results += [PSCustomObject]@{
        Product      = 'vmware-vmx.exe'
        Version      = $fileVer.ProductVersion
        Publisher    = $fileVer.CompanyName
        InstallDate  = (Get-Item $vmxPath).LastWriteTime.ToString('yyyyMMdd')
        Host         = $env:COMPUTERNAME
    }
}

# 3. Flag running VMs (hypervisor processes) that predate patching — must be restarted to load patched code
$vmxProcs = Get-Process -Name 'vmware-vmx' -ErrorAction SilentlyContinue
foreach ($p in $vmxProcs) {
    $results += [PSCustomObject]@{
        Product      = 'RUNNING VM PROCESS (restart required after patch)'
        Version      = $p.StartTime.ToString('yyyy-MM-dd HH:mm')
        Publisher    = $p.Path
        InstallDate  = ''
        Host         = $env:COMPUTERNAME
    }
}

$results | Format-Table -AutoSize
$results | Export-Csv -Path "$env:TEMP\vmware_cve_2026_59346_audit.csv" -NoTypeInformation
Write-Output "Audit complete. Compare installed builds against the fixed versions in Broadcom advisory. Guests must be powered off and vmware-vmx restarted for the patched hypervisor to load."

# macOS Fusion: report installed version and check for running VM processes predating patch
defaults read /Applications/VMware\ Fusion.app/Contents/Info.plist CFBundleShortVersionString 2>/dev/null || echo "Fusion not installed at default path"
ps aux | grep -i 'vmware-vmx' | grep -v grep

# Linux Workstation: report installed version and running vmx processes
vmware --version 2>/dev/null || echo "vmware CLI not found"
rpm -qa 2>/dev/null | grep -i vmware || dpkg -l 2>/dev/null | grep -i vmware
ps aux | grep '[v]mware-vmx'