VMware Fusion Flaw Lets Attackers Gain Root Access

A newly disclosed VMware Fusion flaw could allow attackers to gain root privileges on affected macOS systems. The vulnerability, tracked as CVE-2026-41702, impacts VMware Fusion and carries a CVSS score of 7.8.

Broadcom released security updates on May 14, warning that the issue affects VMware Fusion installations running vulnerable versions. Although the flaw requires local access, security experts say successful exploitation could give attackers full control of the host system.

TOCTOU Vulnerability Impacts VMware Fusion

The VMware Fusion flaw stems from a Time-of-Check Time-of-Use (TOCTOU) weakness involving a SETUID binary. These vulnerabilities occur when a system checks a resource before using it, creating a short timing gap attackers can exploit.

In this case, a local user with non-administrative privileges may abuse the race condition to escalate permissions to root. Consequently, attackers could execute commands with the highest system privileges.

Security researchers often consider SETUID-related flaws highly dangerous because they directly interact with privileged operations. Additionally, local privilege escalation bugs are frequently chained with other exploits after an initial compromise.

Attack Requires Local Access

Unlike remote code execution vulnerabilities, CVE-2026-41702 cannot be exploited over the internet by itself. However, attackers who already gained access through phishing, malware, or stolen credentials could leverage the issue to deepen system compromise.

Researchers noted that the attack complexity remains low. Furthermore, the vulnerability does not require user interaction once the attacker has local access.

Broadcom credited security researcher Mathieu Farrell, also known online as @coiffeur0x90, for privately reporting the issue.

Patched Versions Released

Broadcom confirmed that VMware Fusion 25H2 is vulnerable. The company has now fixed the issue in VMware Fusion 26H1.

Currently, no workaround exists for affected systems. Therefore, organizations and individual users should prioritize upgrading immediately.

Security teams are also advised to:

• Update VMware Fusion to version 26H1
• Restrict local access on shared systems
• Monitor for suspicious privilege escalation attempts
• Audit endpoint activity for unauthorized root access
• Apply endpoint detection and response monitoring

Why Local Privilege Escalation Still Matters

Although remote vulnerabilities often attract more attention, local privilege escalation flaws remain valuable to attackers. Modern threat actors commonly combine multiple weaknesses during intrusions.

For example, malware operators may first compromise a low-privileged account and later exploit local escalation bugs to disable security tools or maintain persistence. As a result, even non-remote vulnerabilities can play a major role in ransomware attacks and targeted intrusions.

The VMware Fusion flaw also highlights the ongoing risks surrounding virtualization software. Because these platforms interact closely with operating systems, security issues can expose sensitive enterprise and developer environments.

Organizations using VMware products should continue monitoring vendor advisories closely, especially as attackers increasingly target virtualization and cloud infrastructure components.