CVE-2026-41702

⚠️ high

Summary

VMware Fusion contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs during an operation performed by a SETUID binary. A malicious actor with local non-administrative user privileges may exploit this vulnerability to escalate privileges to root on the system where Fusion is installed.

CVSS Score

7.8

High

EPSS Score

0.0

Exploit Probability

Published Date

2026-05-15

First Seen: 2026-05-17

📊 Relative Risk Intelligence

This CVE is Moderate Risk - more severe than 69.7% of all 322,079 vulnerabilities in our database.

#97,519

Above average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: May 15, 2026

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

Requires human interaction

💥 Technical Impact

Total

Complete system compromise possible

SSVC data provided by CISA

Last Modified 2026-05-18

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE IDs (Weakness Types)

CWE-367

📦 Affected Products 1

Vendor	Product	Status	Affected Versions
vmware	fusion	Affected	< 26h1

🔗 References 1

https://support.broadcom.com/web/ecx/support-content...

Vendor Advisory

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2025-41236	⛔ critical	9.3	0.0	VMware ESXi, Workstation, and Fusion contain an integer-overflow vulnerability in the VMXNET3 virtual network adapter. ...	2025-07-15
CVE-2025-41237	⛔ critical	9.3	0.0	VMware ESXi, Workstation, and Fusion contain an integer-underflow in VMCI (Virtual Machine Communication Interface) th...	2025-07-15
CVE-2025-41238	⛔ critical	9.3	0.0	VMware ESXi, Workstation, and Fusion contain a heap-overflow vulnerability in the PVSCSI (Paravirtualized SCSI) controll...	2025-07-15
CVE-2025-41239	⚠️ high	7.1	0.0	VMware ESXi, Workstation, Fusion, and VMware Tools contains an information disclosure vulnerability due to the usage of ...	2025-07-15
CVE-2025-41227	🔶 medium	5.5	0.0	VMware ESXi, Workstation, and Fusion contain a denial-of-service vulnerability due to certain guest options. A malicio...	2025-05-20
CVE-2025-22226	⚠️ high	7.1	4.1	VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HG...	2025-03-04

These CVEs affect the same products