The VMware team has published a high-severity remote code execution (RCE) vulnerability, identified as CVE-2024-38811, with a CVSS score of 8.8, in its Fusion hypervisor.

The vulnerability is due to the use of an insecure environment variable; a threat actor with standard user privileges can trigger the flaw to execute code in the context of the Fusion application.