What’s Vulnerable › Vulnerabilities

CVE-2026-59310: vCenter directory-traversal vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2026-08-18
• EPSS: 2.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-30 · updated 2026-09-12
• Weakness: CWE-22

Description

VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.

Summary

VMware vCenter contains a directory traversal flaw in its Syslog server that a remote attacker with network access can exploit to execute arbitrary code. With a CVSS score of 9.8, this is critical, and CISA lists it as actively exploited in the wild. Affected is VMware vCenter Server, fixed in versions 8.0, 9.0.2.0100, and 9.1.0.0300. Apply the vendor fixes or mitigations per CISA BOD 26-04 guidance, evaluate internet exposure, and discontinue use if mitigations are unavailable.

تحتوي أداة VMware vCenter على ثغرة اجتياز مسارات في خادم Syslog، ويمكن لمهاجم يمتلك وصولاً شبكياً إلى vCenter استغلالها لتنفيذ تعليمات برمجية عشوائية. درجة الخطورة 9.8 (حرجة)، وقد أدرجت CISA هذه الثغرة ضمن الثغرات المعروفة المستغلة فعلياً. تتأثر بها منتجات VMware vCenter Server، وقد صدرت إصلاحات في الإصدارات 8.0 و9.0.2.0100 و9.1.0.0300. يجب تطبيق الإصلاحات أو التخفيفات وفق إرشادات CISA BOD 26-04، وتقييم مدى تعرض الأصول للإنترنت، والتوقف عن استخدام المنتج إذا لم تتوفر التخفيفات.

Affected products

• VMware vCenter Server: before 8.0; from 9.0 before 9.0.2.0100; from 9.1 before 9.1.0.0300; 8.0, 8.0-a, 8.0-b, 8.0-c, 8.0-update1, 8.0-update1a (+20) — fixed in 8.0, 9.0.2.0100, 9.1.0.0300
• VMware Cloud Foundation: 9.1.x.x, 9.0.x.x, 5.x
• VMware Telco Cloud Infrastructure: 3.0
• VMware Telco Cloud Platform: 5.1.x, 5.0.x, 4.x, 3.0
• VMware vCenter: from 9.1.x.x before 9.1.0.0300; from 9.0.x.x before 9.0.2.0100; from 8.0 before 8.0 U3k — fixed in 9.1.0.0300, 9.0.2.0100, 8.0 U3k
• VMware vSphere Foundation: 9.1.x.x, 9.0.x.x

How to fix

Upgrade to a fixed version: VMware vCenter Server 8.0, 9.0.2.0100, 9.1.0.0300; VMware vCenter 9.1.0.0300, 9.0.2.0100, 8.0 U3k. Check the vendor advisory for mitigations.

References

• https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017
• https://medium.com/@quirso_de/active-exploitation-of-cve-2026-59310-361-victim-ips-across-47-countries-9783187cc6ff
• https://medium.com/@quirso_de/global-exploitation-of-cve-2026-59310-by-suspected-chinese-nexus-apt-related-cve-2026-59309-443a79e1466d
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-59310

Get alerted when CVE-2026-59310 or the next vulnerability affects your stack