CVE-2026-59310vCenter directory-traversal vulnerability
VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 9.8 | CRITICAL | 3.1vmware (CNA) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
CISA required action
⚡ Known exploited · remediation due Aug 21, 2026
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Details
- CVE ID
- CVE-2026-59310
- Status
- Analyzed
- Assigner (CNA)
- vmware
- Published
- Jul 30, 2026
- Last modified
- 2026-09-12 03:55 UTC
- Weaknesses
- CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Products
As published by the CNA in the CVE record.
VMwareCloud Foundation3 version ranges
- 9.1.x.x
- 9.0.x.x
- 5.x
VMwarevSphere Foundation2 version ranges
- 9.1.x.x
- 9.0.x.x
VMwarevCenter3 version ranges
- 9.1.x.x before 9.1.0.0300
- 9.0.x.x before 9.0.2.0100
- 8.0 before 8.0 U3k
VMwareTelco Cloud Infrastructure1 version range
- 3.0
VMwareTelco Cloud Platform4 version ranges
- 5.1.x
- 5.0.x
- 4.x
- 3.0
References
- support.broadcom.com https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017
- medium.com https://medium.com/@quirso_de/active-exploitation-of-cve-2026-59310-361-victim-ips-across-47-countries-9783187cc6ff
- medium.com https://medium.com/@quirso_de/global-exploitation-of-cve-2026-59310-by-suspected-chinese-nexus-apt-related-cve-2026-59309-443a79e1466d
- cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-59310