CVE-2026-59310
Broadcom VMware vCenter Path Traversal Vulnerability
Description
CVE-2026-59310 is a critical directory traversal (path traversal) vulnerability in the Syslog server component of VMware vCenter that allows a remote, unauthenticated attacker to execute arbitrary code. A malicious actor with network access to vCenter can manipulate file paths to escape the intended directory and ultimately run code on the appliance. Because vCenter is the central management plane for VMware virtualization estates, successful exploitation of this path traversal vulnerability can lead to compromise of the entire virtual infrastructure. With a CVSS score of 9.8, an EPSS score of roughly 46% at the 98th percentile, and a confirmed ransomware association in the CISA Known Exploited Vulnerabilities (KEV) catalog, CVE-2026-59310 demands emergency remediation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| vmware | vcenter server | < 8.0; 8.0; >= 9.0, < 9.0.2.0100; >= 9.1, < 9.1.0.0300 |
References
- https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017(Vendor Advisory)
- https://medium.com/@quirso_de/active-exploitation-of-cve-2026-59310-361-victim-ips-across-47-countries-9783187cc6ff(Third Party Advisory)
- https://medium.com/@quirso_de/global-exploitation-of-cve-2026-59310-by-suspected-chinese-nexus-apt-related-cve-2026-59309-443a79e1466d(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-59310(US Government Resource)
Weakness Type
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Path traversal occurs when software uses external input to build a file path but fails to neutralize special elements such as "../" that let the path resolve outside the intended directory. In CVE-2026-59310 the vCenter Syslog server improperly handles attacker-controlled path data, allowing files to be written or accessed outside their restricted location and escalating into arbitrary code execution on the appliance.
Learn more: CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Impact Analysis
The impact of CVE-2026-59310 is severe because the vulnerability is remotely exploitable over the network with low attack complexity, meaning it is easy to exploit without special conditions. It requires no authentication and no user interaction, so any attacker who can reach the vCenter Syslog service can attempt exploitation. A successful attack yields high impact to confidentiality, integrity and availability, giving the attacker code execution on the vCenter appliance and, by extension, the ability to read sensitive management data, tamper with configurations, and disrupt the virtual environment. Rated CVSS 9.8 (Critical) with an EPSS score of approximately 46% (98th percentile), this vulnerability is being exploited on a large scale, and CISA has confirmed it is used in ransomware campaigns — an escalation from earlier reporting. That matters operationally: ransomware operators target vCenter precisely because encrypting or destroying the management plane and its datastores takes down every virtual machine at once, so compromise here is not a foothold but an extinction-level event for the virtual estate.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2026-59310 and now flags it as known to be used in ransomware campaigns — the most serious classification the KEV catalog applies, and a change from its earlier "unknown" status that reflects observed criminal adoption. Third-party analysis reports large-scale exploitation, with one write-up documenting 361 victim IPs across 47 countries and another attributing global exploitation to a suspected China-nexus APT and noting a relationship to CVE-2026-59309, which suggests the two may be used together in real attacks. The EPSS score of roughly 46%, in the 98th percentile, corroborates sustained mass exploitation. With both a state-aligned actor and ransomware crews operating against the same flaw, any unpatched vCenter should be treated as an active incident, not a scheduling item.
Remediation
- Apply Broadcom's fixed vCenter release immediately. Per CISA's KEV required action, apply mitigations in accordance with vendor instructions and comply with BOD 26-04 guidance; if fixes are unavailable, discontinue use of the product. The KEV due date of 21 August 2026 has long passed and the entry is flagged for known ransomware use.
- Upgrade to a patched vCenter Server version. Update vCenter Server 9.0 to at least 9.0.2.0100 and vCenter Server 9.1 to at least 9.1.0.0300; for 8.0 and earlier branches, apply the corresponding fixed build published by Broadcom in its security advisory.
- Restrict network access to vCenter. Limit access to the vCenter management interfaces and the Syslog service to trusted administrative networks only, using firewall rules and network segmentation to reduce exposure until patching is complete.
- Hunt for indicators of compromise and verify backup integrity. Because active exploitation has been reported across many victims and countries and the flaw is tied to ransomware, review vCenter and Syslog logs for anomalous file writes or path traversal patterns, inspect the appliance for signs of code execution or persistence, and — critically for the ransomware scenario — confirm that backups of vCenter and its managed VMs are recent, restorable and stored offline where an attacker with vCenter access cannot reach or delete them.
- Harden long term by validating and canonicalizing all file paths against an allowlist, keeping vCenter isolated from untrusted networks, enforcing multi-factor authentication for administrative access, and separating backup infrastructure credentials from the virtualization management domain so that one compromise does not eliminate recovery options.
Technical Details
CVE-2026-59310 is a path traversal flaw (CWE-22) in the vCenter Syslog server: the component constructs a pathname from external input without properly neutralizing sequences such as "../", so the resulting path can resolve to a location outside the restricted directory. An attacker leverages this to place or manipulate files at an unintended location, which is then chained into arbitrary code execution on the appliance. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H confirms the attack is network-reachable, low-complexity, and requires neither privileges nor user interaction, which is why a single crafted request to the Syslog service is sufficient for a remote, unauthenticated attacker to break out of the intended directory structure and achieve full compromise.
Frequently Asked Questions
Is CVE-2026-59310 being actively exploited?
Yes, and it is now confirmed in ransomware operations. CISA lists CVE-2026-59310 in its Known Exploited Vulnerabilities catalog with the ransomware flag set to "Known", and third-party reporting describes large-scale exploitation across hundreds of victim IPs in dozens of countries, attributed in part to a suspected China-nexus APT. Its EPSS score of about 46% sits in the 98th percentile.
What products are affected by CVE-2026-59310?
The vulnerability affects Broadcom's VMware vCenter Server, including branches before 8.0 and version 8.0, vCenter Server 9.0 before 9.0.2.0100, and vCenter Server 9.1 before 9.1.0.0300. Environments running these versions with a reachable Syslog service are at risk.
How do I fix CVE-2026-59310?
Upgrade vCenter Server to the fixed build for your branch — at least 9.0.2.0100 for the 9.0 line and 9.1.0.0300 for the 9.1 line — and apply Broadcom's corresponding fix for older releases. Restrict network access to vCenter, hunt for indicators of compromise, and because ransomware use is confirmed, verify that offline backups of vCenter and its managed VMs are current and restorable.
How severe is CVE-2026-59310?
It is Critical, with a CVSS 3.1 base score of 9.8. The flaw is unauthenticated, network-exploitable, requires no user interaction, and leads to arbitrary code execution with high confidentiality, integrity and availability impact; with an EPSS score in the 98th percentile and confirmed use in ransomware campaigns against the management plane of entire virtual estates, it is among the highest-priority fixes outstanding.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.