Reported by 9 outlets

CISA Adds VMware vCenter Path Traversal CVE-2026-59310 to KEV

hot0.0

Why this score

Breadth: 2.00 / 2.0 · 9 sources
Authority: 1.80 / 2.0 · best outlet weight
Severity: 5.00 / 5.0 · CVSS + KEV signals
Velocity: 0.00 / 2.0 · updates in 48h
Pickup speed: 0.24 / 0.6 · time to second source
Recency: × 0.00 temporal multiplier
Community: + 0.00 / 1.5 · reddit signal
Score: 0.0 / 10 = base × recency + community

gbhackers.comsupport.broadcom.comgithub.combleepingcomputer.comcisa.govcyberpress.orgosintsights.commeterpreter.orgmobeta.fr CVE-2026-59310 KEV desk first seen 56d ago

Desk analysis

CVE-2026-59310 is a CWE-22 directory traversal in the VMware vCenter Syslog server, CVSS 9.8, reachable pre-authentication by anyone with network access to the appliance, and it executes arbitrary code. Broadcom patched it on July 29, 2026 in VMSA-2026-0006, the same advisory that fixed CVE-2026-59309, a 9.8 authentication bypass in the VMware Directory Service, both credited to Phil Brass and Matt South of Atredis Partners, with no workarounds for either. The exploitation clock started almost immediately: QUIRSO telemetry shows compromised vCenter hosts beaconing to attacker infrastructure on August 3, five days after the patch, and by August 13 the DFIR firm counted 361 compromised IP addresses across 47 countries, more than half in Germany, the United States, Turkey, Iran and France, driven by a suspected APT actor deploying a reverse SSH tool. CISA added the bug to KEV on August 18 with an August 21 deadline, flagged it as used in ransomware campaigns, and in mid-September confirmed that ransomware gangs had joined the attacks.

This story matters because of what the dates and counts imply, not just what happened. A working exploit existed within five days of the advisory, which means every organization on a quarterly patch cycle was exposed for weeks with the fix already available, and the 361-address compromise list spanning 47 countries shows the campaign was broad and indiscriminate rather than a targeted handful. The vCenter syslog receiver on UDP and TCP 514 is a listener administrators deliberately open to log-forwarding subnets, so network access to it commonly exists deep inside flat internal networks, and reaching it requires no internet exposure at all. The second bug in the same advisory compounds that: CVE-2026-59309 yields unauthenticated access to the vSphere SSO directory, including administrator and solution-user principals, so an environment that patched the syslog flaw but skipped the Directory Service fix, or the reverse, still carries a pre-auth path into the same appliance. And the sequence, suspected APT first in early August, ransomware gangs confirmed by September, is the familiar broker-to-operator handoff, which means hosts compromised in August are encryption candidates now even if nothing has detonated there yet.

The fixes are concrete: vCenter 8.0 U3k or the express 8.0 U2f build, 9.0.2.0100 on the 9.0 line, and 9.1.0.0300 for 9.1, which first carried the fix in 9.1.0.0200; Cloud Foundation 5.x takes an async patch to 8.0 U3k per KB88287, and 7.0 requires a Broadcom extended-support contract. Pending that, restrict inbound UDP/514, TCP/514 and TLS syslog on 6514 to known forwarders only, and limit the Directory Service LDAP ports 389, 636 and 2020 to management networks, since CVE-2026-59309 needs nothing but a TCP connection and an account name. The specific hunt: syslog receiver logs showing HOSTNAME or APP-NAME header values containing ../ or path separators, which are invalid under RFC 5424 and have no legitimate sender; new files under /var/log/vmware or in the VAMI web root /opt/vmware/share/htdocs written by rsyslogd, which can also be checked by fetching unexpected paths over the management port 5480; and unexpected outbound SSH sessions from the vCenter appliance itself, the persistence pattern QUIRSO documented. CISA's KEV entry carries a forensic triage requirement, so any vCenter that missed the August 21 date should be treated as potentially breached, not merely unpatched.

Two developments would change this assessment. Named attribution of the ransomware gangs with IoCs would convert QUIRSO's August victim list into a concrete prioritize-for-compromise-assessment queue, and any upswing in the Shadowserver count above the roughly 450 internet-exposed vCenter instances it tracks would signal a fresh scanning wave. The other is public weaponization of CVE-2026-59309: patch-diff work published on September 22 demonstrated the syslog write primitive end to end and a working Directory Service bypass, and reliable public tooling for that bug would widen the attacker pool well beyond the current APT and ransomware set.

Timeline

original reporting

CISA Warns Hackers Are Actively Exploiting VMware vCenter Path Traversal Flaw

gbhackers.com · 55d ago · August 19th, 2026

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability affecting Broadcom VMware vCenter to its Known Exploited Vulnerabilities (KEV) Catalog. The vulnerability, tracked as CVE-2026-59310, is a path traversal flaw that enables arbitrary code execution in affected vCenter deployments. VMware vCenter Path Traversal Flaw CVE-2026-59310 impacts the VMware vCenter Syslog Server […] The post CISA Warns Hackers Are Actively Exploiting VMware vCenter Path Traversal Flaw appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
update from support.broadcom.com

VMSA-2026-0006: VMware ESX, vCenter, Workstation, and Fusion updates address multiple vulnerabilities (CVE-2026-59309, CVE-2026-59310, CVE-2026-47876, CVE-2026-41703, CVE-2026-41709)

support.broadcom.com · 77d ago · July 29th, 2026

Broadcom's initial advisory, issue date July 29, 2026, describes CVE-2026-59310 as a directory traversal in the vCenter Syslog server with a maximum CVSSv3 base score of 9.8, exploitable by any malicious actor with network access to vCenter to execute arbitrary code, with no workarounds. The same advisory fixes CVE-2026-59309, a 9.8 authentication bypass in the VMware Directory Service, and credits Phil Brass and Matt South of Atredis Partners for reporting both. Fixed builds include vCenter 8.0 U3k, 9.0.2.0100 and 9.1.0.0300, with express 8.0 U2f patches added in the August 3 revision and 7.0 guidance in the August 19 revision.
update from github.com

VMSA-2026-0006 supplemental FAQ (vmware/vcf-security-and-compliance-guidelines)

github.com · 76d ago · July 29th, 2026

The vendor's supplemental FAQ linked from VMSA-2026-0006 as additional documentation for both vCenter CVEs was published in the vmware/vcf-security-and-compliance-guidelines GitHub repository, with the first Q&A commits dated July 29, 2026. Later reporting characterized its guidance as telling customers to treat fixing CVE-2026-59310 as an emergency and install patches as soon as possible.
update from bleepingcomputer.com

VMware fixes three critical flaws allowing auth bypass, VM escapes

bleepingcomputer.com · 75d ago · July 30th, 2026

First news coverage of VMSA-2026-0006, published July 30, 2026, reports that Broadcom released updates fixing five vulnerabilities across vCenter, ESX, Workstation and Fusion, including three critical flaws allowing authentication bypass, arbitrary code execution, and escape from a virtual machine to the host.
update from bleepingcomputer.com

Critical VMware vCenter RCE flaw exploited for reverse SSH access

bleepingcomputer.com · 61d ago · August 13th, 2026

Reporting on DFIR firm QUIRSO's findings published August 13, 2026: CVE-2026-59310 was being exploited in an active campaign deploying a reverse SSH tool for persistence and remote access, with compromised systems first connecting to attacker-controlled infrastructure on August 3, five days after the patch. QUIRSO identified compromises at 361 IP addresses across 47 countries, more than half in Germany, the U.S., Turkey, Iran and France, attributed to a suspected APT actor.
update from cisa.gov

Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability (KEV catalog entry)

cisa.gov · 57d ago · August 18th, 2026

CISA added CVE-2026-33824 to the Known Exploited Vulnerabilities catalog on August 18, 2026, one day before the story's first coverage, stating the double free could enable remote code execution. The entry sets a remediation due date of August 21, 2026 for federal agencies under BOD 26-04 guidance and marks known ransomware campaign use as Unknown.
update from cyberpress.org

CISA Warns of VMware vCenter Path Traversal Flaw Exploited in the Wild

cyberpress.org · 56d ago · August 19th, 2026

Path traversal flaws occur when an application fails to properly validate file paths supplied by a user or a remote system. An attacker can exploit this weakness to access files or directories outside the intended application path, potentially bypassing security restrictions. In the case of VMware vCenter, successful exploitation could allow a network-based attacker to execute arbitrary code. Because vCenter Server is a central management platform for VMware virtualized environments, a compromise could give an adversary a strategic foothold into enterprise infrastructure. Threat actors that gain control of vCenter may be able to manipulate virtual machine configurations, access sensitive workloads, deploy malicious virtual machines, disable defensive controls, or move laterally across the environment. The platform’s privileged role
update from bleepingcomputer.com

CISA: Critical VMware RCE flaw now exploited by ransomware gangs

bleepingcomputer.com · 28d ago · September 15th, 2026

Cybersecurity and Infrastructure Security Agency (CISA) warned security teams that ransomware gangs have now joined ongoing attacks exploiting a critical VMware vCenter vulnerability patched in July. Two weeks later, digital forensics and incident response (DFIR) company QUIRSO reported finding over 361 IP addresses across 47 countries compromised after a suspected advanced persistent threat (APT) actor began exploiting the vulnerability to deploy a reverse SSH tool for persistence and remote access. Over the weekend, CISA updated its KEV catalog again to flag the security vulnerability as actively abused by ransomware gangs . Internet security threat monitor Shadowserver currently tracks over 450 VMware vCenter servers exposed online ; however, there is no information on how many have already been patched against this flaw. VMware targeted by ransom
update from osintsights.com

Ransomware gangs exploit VMware flaw Ransomware gangs are actively exploiting a critical VMware flaw, CVE-2026-59310, that was patched just

osintsights.com · 28d ago · September 15th, 2026

Ransomware gangs exploit VMware flaw Ransomware gangs are actively exploiting a critical VMware flaw, CVE-2026-59310, that was patched just

via Mastodon https://osintsights.com/ransomware-gangs-exploit-vmware-flaw?utm_source=mastodon&utm_medium=social
mentioned by www.bleepingcomputer.com

"CISA: Critical VMware RCE flaw now exploited by ransomware gangs" "[...] Cybersecurity and Infrastructure Security Agency (CISA) warned sec

www.bleepingcomputer.com · 28d ago · September 15th, 2026
mentioned by www.bleepingcomputer.com

🤖 CVE-2026-59310: critical directory traversal in VMware vCenter Syslog server, unauthenticated RCE. Patched Jul 29, exploited in the wild,

www.bleepingcomputer.com · 28d ago · September 15th, 2026
mentioned by www.bleepingcomputer.com

🤖 CISA: ransomware gangs have now joined ongoing attacks exploiting a critical VMware vCenter RCE patched in July. Unpatched vCenter instanc

www.bleepingcomputer.com · 28d ago · September 16th, 2026
mentioned by www.bleepingcomputer.com

CISA: Critical # VMware RCE flaw now exploited by # ransomware gangs https://www. bleepingcomputer.com/news/secu rity/cisa-critical-vmware-v

www.bleepingcomputer.com · 27d ago · September 16th, 2026
update from meterpreter.org

Discover how ransomware gangs actively exploit the critical VMware vCenter flaw, CVE-2026-59310. Learn about the swift weaponization and sev

meterpreter.org · 26d ago · September 17th, 2026

Learn about the swift weaponization and sev

via Mastodon https://meterpreter.org/vmware-vcenter-flaw-cve-2026-59310/?utm_source=mastodon&utm_medium=jetpack_social
update from mobeta.fr

Woops: * https:// mobeta.fr/blog/vcenter-cve-202 6-59309-cve-2026-59310/ # threatintel , # vmware

mobeta.fr · 21d ago · September 22nd, 2026

Woops: * https:// mobeta.fr/blog/vcenter-cve-202 6-59309-cve-2026-59310/ # threatintel , # vmware

via Mastodon https://mobeta.fr/blog/vcenter-cve-2026-59309-cve-2026-59310/
mentioned by mobeta.fr

Pre-Auth vCenter RCE # threatintel # vmwarw https:// mobeta.fr/blog/vcenter-cve-202 6-59309-cve-2026-59310/

mobeta.fr · 21d ago · September 22nd, 2026

Covered in

digest 2026-09-16 digest 2026-08-19