CVE-2026-22715

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22715", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "state": "PUBLISHED", "assignerShortName": "vmware", "dateReserved": "2026-01-09T06:54:36.840Z", "datePublished": "2026-02-26T18:29:14.190Z", "dateUpdated": "2026-02-27T17:55:10.640Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "packageName": "VMware Workstation", "platforms": ["Linux", "Windows"], "product": "Workstation", "vendor": "VMware", "versions": [{"lessThan": "25H2U1", "status": "affected", "version": "17.0", "versionType": "custom"}, {"status": "unaffected", "version": "25H2U1", "versionType": "custom"}]}, {"defaultStatus": "affected", "packageName": "ProductB", "platforms": ["MacOS"], "product": "Fusion", "vendor": "VMware", "versions": [{"lessThan": "25H2U1", "status": "affected", "version": "13.0", "versionType": "custom"}, {"status": "unaffected", "version": "25H2U1", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Broadcom would like to thank Ao Wang, Yuxiang Yang, Ke Xu, Xuewei Feng, Qi Li, and Xueying Li for reporting this issue to us."}], "datePublic": "2026-02-26T07:33:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>VMWare Workstation and Fusion contain a logic flaw in the management of network packets.&nbsp;</p><p>Known attack vectors: A malicious actor with administrative privileges on a Guest VM may be able to interrupt or intercept network connections of other Guest VM's.&nbsp;</p><p>Resolution: To remediate CVE-2026-22715 please upgrade to VMware Workstation or Fusion Version 25H2U1</p>"}], "value": "VMWare Workstation and Fusion contain a logic flaw in the management of network packets.\u00a0\n\nKnown attack vectors: A malicious actor with administrative privileges on a Guest VM may be able to interrupt or intercept network connections of other Guest VM's.\u00a0\n\nResolution: To remediate CVE-2026-22715 please upgrade to VMware Workstation or Fusion Version 25H2U1"}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "LOW", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2026-02-26T18:36:41.929Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36986"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>To remediate CVE-2026-22715 please upgrade to VMwate Workstation or Fusion Version 25H2U1</p>"}], "value": "To remediate CVE-2026-22715 please upgrade to VMwate Workstation or Fusion Version 25H2U1"}], "source": {"discovery": "UNKNOWN"}, "title": "VMware Workstation/Fusion NAT vulnerability", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-923", "lang": "en", "description": "CWE-923 Improper Restriction of Communication Channel to Intended Endpoints"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-27T17:55:05.951870Z", "id": "CVE-2026-22715", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-27T17:55:10.640Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22715", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-27T17:55:05.951870Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-923", "description": "CWE-923 Improper Restriction of Communication Channel to Intended Endpoints"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-27T17:54:58.149Z"}}], "cna": {"title": "VMware Workstation/Fusion NAT vulnerability", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "Broadcom would like to thank Ao Wang, Yuxiang Yang, Ke Xu, Xuewei Feng, Qi Li, and Xueying Li for reporting this issue to us."}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "VMware", "product": "Workstation", "versions": [{"status": "affected", "version": "17.0", "lessThan": "25H2U1", "versionType": "custom"}, {"status": "unaffected", "version": "25H2U1", "versionType": "custom"}], "platforms": ["Linux", "Windows"], "packageName": "VMware Workstation", "defaultStatus": "affected"}, {"vendor": "VMware", "product": "Fusion", "versions": [{"status": "affected", "version": "13.0", "lessThan": "25H2U1", "versionType": "custom"}, {"status": "unaffected", "version": "25H2U1", "versionType": "custom"}], "platforms": ["MacOS"], "packageName": "ProductB", "defaultStatus": "affected"}], "solutions": [{"lang": "en", "value": "To remediate CVE-2026-22715 please upgrade to VMwate Workstation or Fusion Version 25H2U1", "supportingMedia": [{"type": "text/html", "value": "<p>To remediate CVE-2026-22715 please upgrade to VMwate Workstation or Fusion Version 25H2U1</p>", "base64": false}]}], "datePublic": "2026-02-26T07:33:00.000Z", "references": [{"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36986", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "VMWare Workstation and Fusion contain a logic flaw in the management of network packets.\u00a0\n\nKnown attack vectors: A malicious actor with administrative privileges on a Guest VM may be able to interrupt or intercept network connections of other Guest VM's.\u00a0\n\nResolution: To remediate CVE-2026-22715 please upgrade to VMware Workstation or Fusion Version 25H2U1", "supportingMedia": [{"type": "text/html", "value": "<p>VMWare Workstation and Fusion contain a logic flaw in the management of network packets.&nbsp;</p><p>Known attack vectors: A malicious actor with administrative privileges on a Guest VM may be able to interrupt or intercept network connections of other Guest VM's.&nbsp;</p><p>Resolution: To remediate CVE-2026-22715 please upgrade to VMware Workstation or Fusion Version 25H2U1</p>", "base64": false}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2026-02-26T18:36:41.929Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22715", "state": "PUBLISHED", "dateUpdated": "2026-02-27T17:55:10.640Z", "dateReserved": "2026-01-09T06:54:36.840Z", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "datePublished": "2026-02-26T18:29:14.190Z", "assignerShortName": "vmware"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "packageName": "VMware Workstation", "platforms": ["Linux", "Windows"], "product": "Workstation", "vendor": "VMware", "versions": [{"lessThan": "25H2U1", "status": "affected", "version": "17.0", "versionType": "custom"}, {"status": "unaffected", "version": "25H2U1", "versionType": "custom"}]}, {"defaultStatus": "affected", "packageName": "ProductB", "platforms": ["MacOS"], "product": "Fusion", "vendor": "VMware", "versions": [{"lessThan": "25H2U1", "status": "affected", "version": "13.0", "versionType": "custom"}, {"status": "unaffected", "version": "25H2U1", "versionType": "custom"}]}], "source": "security@vmware.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "VMWare Workstation and Fusion contain a logic flaw in the management of network packets.\u00a0\n\nKnown attack vectors: A malicious actor with administrative privileges on a Guest VM may be able to interrupt or intercept network connections of other Guest VM's.\u00a0\n\nResolution: To remediate CVE-2026-22715 please upgrade to VMware Workstation or Fusion Version 25H2U1"}, {"lang": "es", "value": "VMWare Workstation y Fusion contienen una falla l\u00f3gica en la gesti\u00f3n de paquetes de red.\n\nVectores de ataque conocidos: Un actor malicioso con privilegios administrativos en una VM invitada podr\u00eda interrumpir o interceptar las conexiones de red de otras VM invitadas.\n\nResoluci\u00f3n: Para remediar CVE-2026-22715, actualice a VMware Workstation o Fusion Versi\u00f3n 25H2U1"}], "id": "CVE-2026-22715", "lastModified": "2026-06-17T10:20:17.233", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "LOW", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 4.2, "source": "security@vmware.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22715", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-27T17:55:05.951870Z", "version": "2.0.3"}}]}, "published": "2026-02-26T19:32:37.893", "references": [{"source": "security@vmware.com", "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36986"}], "sourceIdentifier": "security@vmware.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-923"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["macos"], "status": "affected", "versions": {"scheme": "generic", "value": "[13.0,25H2U1)"}}, {"platform": ["macos"], "status": "unaffected", "versions": {"scheme": "generic", "value": "25H2U1"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Fusion", "source": "cna", "vendor": "VMware"}, "product": "fusion", "vendor": "vmware"}, {"configurations": [{"platform": ["linux", "windows"], "status": "affected", "versions": {"scheme": "generic", "value": "[17.0,25H2U1)"}}, {"platform": ["linux", "windows"], "status": "unaffected", "versions": {"scheme": "generic", "value": "25H2U1"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Workstation", "source": "cna", "vendor": "VMware"}, "product": "workstation", "vendor": "vmware"}], "analysis": {"en": {"generated_at": "2026-04-18T10:22:29.992248+00:00", "value": {"mitigation_remediation": ["Apply VMware's official upgrade to Workstation or Fusion version 25H2U1 or later to eliminate the logic flaw in packet handling.", "Limit administrative rights within guest virtual machines to reduce the likelihood that an attacker can utilize the vulnerability to affect other guests.", "If an upgrade cannot be performed immediately, consider disabling NAT networking for guest VMs or moving critical guests to isolated networks to prevent cross\u2011VM traffic manipulation."], "summary": {"action": "Upgrade", "impact": "Network Interception / Disruption"}, "threat_synthesis": {"affected_systems": "The flaw impacts VMware Fusion and VMware Workstation products. All currently supported versions released before version\u00a025H2U1 are potentially affected, as the advisory does not list any specific version range but specifies that the fix is included in 25H2U1. VMware did not enumerate affected minor releases, so administrators should assume all earlier builds are vulnerable.", "description_and_impact": "Vulnerability in VMware Workstation and Fusion arises from a logic flaw in how the software manages network packets, a weakness identified as CWE-923. This flaw enables a malicious actor who has administrative privileges within a Guest virtual machine to interrupt or intercept the network connections of other Guest VMs on the same host. The misuse of packet handling can lead to service disruption or the unauthorized takedown of traffic between guests, exposing data exchange and potentially harming availability for the affected virtual machines.", "risk_and_exploitability": "The CVSS score of\u00a05.9 indicates a moderate risk. The EPSS score of less than\u00a01\u00a0% suggests a very low probability of exploitation in the general population. VMware has not listed this issue in the CISA KEV catalog, so there is no known active exploitation campaign. Exploitation requires that the attacker runs as an administrator inside a Guest VM, so they must already have control over that VM. The attack vector is local to the host, with the attacker able to hijack traffic routes between guests, potentially enabling denial of service or passive data interception. Overall, the risk is moderate but limited by the attacker\u2019s need for elevated VM privileges."}}}}, "created": "2026-02-27T09:07:13.771728+00:00", "updated": "2026-04-18T10:30:35.760839+00:00", "vendors": ["vmware", "vmware$PRODUCT$fusion", "vmware$PRODUCT$workstation"]}