CVE-2026-59310
Broadcom VMware vCenter Path Traversal Vulnerability
Description
CVE-2026-59310 is a critical directory traversal (path traversal) vulnerability in the Syslog server component of VMware vCenter that allows a remote, unauthenticated attacker to execute arbitrary code. Discovered in Broadcom's VMware vCenter, the flaw lets a malicious actor with network access to vCenter manipulate file paths to escape the intended directory and ultimately run code on the appliance. Because vCenter is the central management plane for VMware virtualization estates, successful exploitation of this path traversal vulnerability can lead to compromise of the entire virtual infrastructure. With a CVSS score of 9.8 and confirmed active exploitation, CVE-2026-59310 has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog and demands immediate remediation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| vmware | vcenter server | < 8.0; 8.0; >= 9.0, < 9.0.2.0100; >= 9.1, < 9.1.0.0300 |
References
- https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017(Vendor Advisory)
- https://medium.com/@quirso_de/active-exploitation-of-cve-2026-59310-361-victim-ips-across-47-countries-9783187cc6ff(Third Party Advisory)
- https://medium.com/@quirso_de/global-exploitation-of-cve-2026-59310-by-suspected-chinese-nexus-apt-related-cve-2026-59309-443a79e1466d(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-59310(US Government Resource)
Weakness Type
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Path traversal occurs when software uses external input to build a file path but fails to neutralize special elements such as "../" that let the path resolve outside the intended directory. In CVE-2026-59310 the vCenter Syslog server improperly handles attacker-controlled path data, allowing files to be written or accessed outside their restricted location and escalating into arbitrary code execution on the appliance.
Learn more: CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Impact Analysis
The impact of CVE-2026-59310 is severe because the vulnerability is remotely exploitable over the network with low attack complexity, meaning it is easy to exploit without special conditions. It requires no authentication and no user interaction, so any attacker who can reach the vCenter Syslog service can attempt exploitation. A successful attack yields high impact to confidentiality, integrity, and availability, giving the attacker code execution on the vCenter appliance and, by extension, the ability to read sensitive management data, tamper with configurations, and disrupt the virtual environment. Rated CVSS 9.8 (Critical) with an EPSS score of roughly 2.4% (82nd percentile), the vulnerability is already being exploited in the wild according to CISA, which elevates the practical risk well beyond what the EPSS figure alone suggests.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2026-59310 by adding it to the Known Exploited Vulnerabilities catalog, so this must be treated as an in-the-wild threat. Third-party analysis referenced for this vulnerability reports large-scale exploitation — hundreds of victim IPs across dozens of countries — and attributes activity to a suspected China-nexus APT, noting a relationship to CVE-2026-59309, which suggests the two may be used together in real attacks. While the EPSS score of about 2.4% (82nd percentile) appears modest, the confirmed and widespread exploitation makes the real-world likelihood of attack far higher. The KEV ransomware flag is "Unknown," but given the demonstrated targeting of vCenter, defenders should assume working exploit techniques are circulating and prioritize patching and threat hunting.
Remediation
- Apply Broadcom's fixed vCenter release immediately. Per CISA's KEV required action, apply mitigations in accordance with vendor instructions and comply with BOD 26-04 guidance; if fixes are unavailable, discontinue use of the product.
- Upgrade to a patched vCenter Server version. Update vCenter Server 9.0 to at least 9.0.2.0100 and vCenter Server 9.1 to at least 9.1.0.0300; for 8.0 and earlier branches, apply the corresponding fixed build published by Broadcom.
- Restrict network access to vCenter. Limit access to the vCenter management interfaces and the Syslog service to trusted administrative networks only, using firewall rules and network segmentation to reduce exposure until patching is complete.
- Hunt for indicators of compromise. Because active exploitation has been reported across many victims and countries, review vCenter and Syslog logs for anomalous file writes or path traversal patterns and inspect the appliance for signs of code execution or persistence.
- Harden long term by validating and canonicalizing all file paths against an allowlist and by keeping vCenter isolated from untrusted networks.
Technical Details
CVE-2026-59310 is a path traversal flaw (CWE-22) in the vCenter Syslog server: the component constructs a pathname from external input without properly neutralizing sequences such as "../", so the resulting path can resolve to a location outside the restricted directory. An attacker leverages this to place or manipulate files at an unintended location, which is then chained into arbitrary code execution on the appliance. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H confirms the attack is network-reachable, low-complexity, and requires neither privileges nor user interaction, which is why a single crafted request to the Syslog service is sufficient for a remote, unauthenticated attacker to break out of the intended directory structure and achieve full compromise.
Frequently Asked Questions
Is CVE-2026-59310 being actively exploited?
Yes. CISA has added CVE-2026-59310 to its Known Exploited Vulnerabilities catalog, confirming active exploitation. Third-party reporting describes large-scale exploitation across hundreds of victim IPs in dozens of countries, attributed to a suspected China-nexus APT.
What products are affected by CVE-2026-59310?
The vulnerability affects Broadcom's VMware vCenter Server, including branches before 8.0 and version 8.0, vCenter Server 9.0 before 9.0.2.0100, and vCenter Server 9.1 before 9.1.0.0300. Environments running these versions with a reachable Syslog service are at risk.
How do I fix CVE-2026-59310?
Upgrade vCenter Server to the fixed build for your branch — at least 9.0.2.0100 for the 9.0 line and 9.1.0.0300 for the 9.1 line — and apply Broadcom's corresponding fix for older releases. Restrict network access to vCenter and hunt for indicators of compromise, following CISA's KEV/BOD 26-04 guidance.
How severe is CVE-2026-59310?
It is Critical, with a CVSS 3.1 base score of 9.8. The flaw is unauthenticated, network-exploitable, requires no user interaction, and leads to arbitrary code execution with high confidentiality, integrity, and availability impact; combined with confirmed active exploitation, it is a top-priority fix despite an EPSS score in the 82nd percentile.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.