Summary

A critical directory traversal vulnerability, CVE-2026-59310, has been identified in the VMware vCenter Syslog server component. This vulnerability allows a remote, unauthenticated attacker with network access to a vulnerable vCenter instance to execute arbitrary code on the underlying system. Successful exploitation could result in complete compromise of the vCenter server and provide attackers with a foothold to further compromise the virtualized environment.

The vulnerability has a CVSSv3 score of 9.8 (Critical) and has been reported as actively exploited in the wild, increasing the urgency for organizations to identify and remediate affected systems.

Affected Systems and/or Applications

The following VMware products are affected:

• VMware Cloud Foundation (9.1.x.x, 9.0.x.x, 5.x)
• VMware vSphere Foundation (9.1.x.x, 9.0.x.x)
• VMware vCenter (9.1.x.x prior to 9.1.0.0300, 9.0.x.x prior to 9.0.2.0100, 8.0 prior to 8.0 U3k)
• VMware Telco Cloud Infrastructure 3.0
• VMware Telco Cloud Platform (5.1.x, 5.0.x, 4.x, 3.0)

Technical Details

CVE-2026-59310 is a directory traversal vulnerability (CWE-22) affecting VMware vCenter's Syslog server. The flaw allows attackers to manipulate file path handling mechanisms and access files or directories outside of the intended scope.

Because the vulnerability is exploitable remotely over the network and does not require authentication or user interaction, it presents a significant risk to exposed vCenter environments.

The vulnerability can be exploited through the following process:

1. An attacker gains network connectivity to a vulnerable vCenter server.
2. Crafted requests are used to manipulate file paths and access restricted directories.
3. The attacker leverages access to sensitive files and configurations to achieve arbitrary code execution on the target system.

Public proof-of-concept and exploit code have been published, and multiple reports indicate active exploitation of vulnerable systems. Organizations should treat internet-accessible and unpatched vCenter servers as high-priority remediation targets.

Mitigation

To mitigate this vulnerability, organizations should:

• Immediately apply VMware security updates for affected products.
• Upgrade VMware vCenter to one of the following fixed versions:
• Version 9.1.0.0300 or later
• Version 9.0.2.0100 or later
• Version 8.0 U3k or later
• Restrict network access to vCenter management interfaces to authorized administrative systems only.
• Implement network segmentation to reduce exposure of management infrastructure.

What the Cyber Fusion Center is Doing

The CFC is actively monitoring threat intelligence and reports related to CVE-2026-59310. This advisory will be updated if required.

References

• Broadcom Security Advisory
• CISA Known Exploited Vulnerabilities Catalog
• MITRE CVE Record - CVE-2026-59310

‍