{"id":"CVE-2026-59310","kind":"vulnerability","aliases":["CVE-2026-59310"],"related":[],"title":"vmware vcenter server: VMware vCenter contains a directory traversal vulnerability in the Syslog server","description":"Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"A path traversal flaw in Broadcom VMware vCenter lets an attacker with network access to vCenter execute arbitrary code. CISA lists it as actively exploited in the wild, with ransomware use noted in the tags.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2026-08-18T00:00:00+00:00","products":[{"name":"Broadcom VMware vCenter","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"vmware vcenter server","fixed":["8.0"],"affected":"< 8.0","ecosystem":"vendor"},{"name":"vmware vcenter server","fixed":[],"affected":"= 8.0","ecosystem":"vendor"},{"name":"vmware vcenter server","fixed":["9.0.2.0100"],"affected":">= 9.0, < 9.0.2.0100","ecosystem":"vendor"},{"name":"vmware vcenter server","fixed":["9.1.0.0300"],"affected":">= 9.1, < 9.1.0.0300","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","on-prem-virtualization","ransomware","vcenter","vendor","vmware","vsphere"],"not_affected_if":["no-vcenter-deployed","patched-build"],"how_to_check":"Identify your vCenter version and build from the vSphere Client or the VAMI page; compare against the fixed builds in the Broadcom advisory. Review vCenter access and logs for unexpected file access or unknown processes.","fix":"Apply the Broadcom VMware vCenter patch or mitigation per the vendor advisory, then follow CISA BOD 26-04 guidance and the Forensics Triage Requirements. If no mitigation is available, discontinue use of the affected product per CISA direction.","status":"open","published_at":"2026-07-30T13:16:53+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:31:57+00:00","updated_at":"2026-10-23T23:44:52+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-23T20:31:57Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Broadcom VMware vCenter patch or mitigation per the vendor advisory, then follow CISA BOD 26-04 guidance and the Forensics Triage Requirements. If no mitigation is available, discontinue use of the affected product per CISA direction.","summary":"A path traversal flaw in Broadcom VMware vCenter lets an attacker with network access to vCenter execute arbitrary code. CISA lists it as actively exploited in the wild, with ransomware use noted in the tags.","category":"vendor","who_cares":["vmware","vcenter","on-prem-virtualization","vsphere"],"confidence":0.7,"analyst_note":"Affected and fixed versions are unknown from the sources; find the Broadcom advisory for CVE-2026-59310 and the exact fixed builds and mitigations.","how_to_check":"Identify your vCenter version and build from the vSphere Client or the VAMI page; compare against the fixed builds in the Broadcom advisory. Review vCenter access and logs for unexpected file access or unknown processes.","needs_analyst":true,"not_affected_if":["no-vcenter-deployed","patched-build"],"severity_if_unknown":"high"},"cost_usd":0.000428,"input_tokens":2205,"output_tokens":414,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-04':121C,147C,178C '-2026':16A,19A '-59310':17A,20A '26':120C,146C,177C 'access':59B,97C 'accord':110C 'action':106C 'activ':69B 'actor':94C 'adher':174C 'allow':91C 'appli':107C 'applic':144C 'arbitrari':63B,102C 'asset':168C 'attack':56B 'base':125C 'bod':119C,145C,176C 'broadcom':21A,51B,81C 'cisa':65B,104C,117C,134C 'cloud':150C 'code':64B,103C 'complianc':115C 'contain':6A,84C 'could':90C 'cve':15A,18A 'directori':8A 'discontinu':153C 'ensur':114C,173C 'evalu':166C 'execut':62B,101C 'exploit':36B,70B 'exposur':171C 'flaw':49B 'follow':143C 'forens':136C 'guidanc':132C,148C 'guidelin':180C 'instruct':113C 'internet':170C 'let':54B 'list':66B 'mitig':108C,159C 'network':58B,96C 'note':77B,131C,142C 'on-prem-virtu':37B 'patch':179C 'path':47B,86C 'prem':39B 'priorit':122C 'product':157C 'ransomwar':41B,75B 'requir':105C,138C 'respons':164C 'risk':127C 'secur':123C 'see':128C,139C 'server':3A,14A,26A,29A,32A,35A 'servic':151C 'stakehold':162C 'syslog':13A 'tag':80B 'threat':93C 'travers':9A,48B,87C 'triag':137C 'unavail':161C 'updat':124C 'url':129C,140C 'use':76B,154C 'vcenter':2A,5A,23A,25A,28A,31A,34A,42B,53B,61B,83C,99C 'vendor':43B,112C 'virtual':40B 'vmware':1A,4A,22A,24A,27A,30A,33A,44B,52B,82C 'vsphere':45B 'vulner':10A,88C 'wild':73B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-07-30T13:16:53+00:00","kev":{"dateAdded":"2026-08-18","dueDate":"2026-08-21","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@vmware.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-59310","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-59310","severity":null,"published_at":"2026-08-18T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T14:39:37+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-59310","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59310","severity":null,"published_at":"2026-07-30T13:16:53+00:00","modified_at":"2026-08-19T04:17:24+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}