CVE-2026-59310

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-59310 9.8

Broadcom · VMware vCenter · Added 2026-08-18 · Published 2026-07-30

3-Day Required KEV Automatable Active Exploitation

Details

VulnerabilityBroadcom VMware vCenter Path Traversal Vulnerability

VendorBroadcom

ProductVMware vCenter

Date added2026-08-18

Due date2026-08-21

CISA catalogView on CISA KEV catalog

Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CWECWE-22

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code.

NVD: VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-08-18 17:53 UTC

Wall time0.5s

Searches1

Component defaultyes

Sources https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017
https://nvd.nist.gov/vuln/detail/CVE-2026-59310
https://www.rapid7.com/blog/post/etr-critical-vmware-vcenter-vulnerabilities-allow-authentication-bypass-and-remote-code-execution-cve-2026-59309-cve-2026-59310/
https://vulnipulse.com/advisories/vmware-cve-2026-59310
https://www.decryptiondigest.com/blog/vmware-vcenter-cve-2026-59310-reverse-ssh-patch
https://knowledge.broadcom.com/external/article/449886/vmware-response-to-vmsa20260006-cve20265.html

Hunting hypothesis agent

Hunt for directory traversal payloads targeting the vCenter Syslog listener on port 514, looking for path sequences like ../../../ that write to executable locations.

Research details

ComponentvCenter Syslog server (directory traversal in syslog listener)

PreconditionsUnauthenticated network access to the vCenter Syslog service (typically TCP/UDP 514); the Syslog server component is enabled by default on all vCenter installations; target must be running a vulnerable version of VMware vCenter prior to the VMSA-2026-0006 patch. agent

DeliveryNetwork (Syslog protocol)

Public PoCno

Advisoryhttps://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017

Exploit notesCVSS attack complexity: LOW | CRITICAL severity (CVSS >= 9.0) | Directory traversal in Syslog allows arbitrary file write leading to RCE | Actively exploited within 5 days of advisory publication across 47 countries

SummaryBroadcom VMware vCenter Syslog server directory traversal enabling unauthenticated remote code execution. CVSS 9.8; patched in VMSA-2026-0006 (July 29 2026). No public PoC yet but actively exploited in the wild.

Tia coverage

First reported2026-07-30

First exploit report2026-08-12

Exploit report → KEV6 days before the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

cisa-adds-vmware-vcenter-path-traversal-cve-2026-59310-to-kev critical-vm-escape-vulnerability-patched-in-vmware-esxi-cve-2026 hackers-exploit-critical-vmware-vcenter-flaw-to-deploy-reverse-s suspected-chinese-hackers-turn-vmware-vcenter-rce-into-root-back

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.