Advisory · CVE-2026-59310
Attackers are exploiting a critical VMware vCenter code-execution flaw
A critical directory-traversal flaw in the vCenter Syslog server can allow an unauthenticated network attacker to execute arbitrary code.
- Vendor
- Broadcom
- Product
- VMware vCenter
- Identifier / CWE
- CVE-2026-59310
CWE-22 - Action timing
- Aug 21, 2026
Explain it like I’m five
The vCenter log service can be tricked into leaving the folder it is supposed to use. An attacker can abuse that path to place or reach files that make the management server run their code.
- 01Network request
An unauthenticated attacker reaches the vCenter Syslog service.
- 02Path escapes
A crafted path traverses outside the directory the service expects to use.
- 03Server manipulated
The attacker abuses filesystem access to influence the vCenter host.
- 04Code execution
Arbitrary code runs inside a system trusted to manage the virtual estate.
What happened
CISA added CVE-2026-59310 to the Known Exploited Vulnerabilities catalog on August 18, 2026. Broadcom rates the vCenter directory-traversal vulnerability critical at CVSS 9.8 and says a malicious actor with network access can execute arbitrary code. No workaround is available.
vCenter is a control plane for virtual infrastructure. Compromise can expose administrative credentials, host and guest operations, backups, snapshots, and the trust relationships used to manage a large part of an environment.
What to do
- Inventory every vCenter instance and map which management networks and external sources can reach it.
- Follow the Broadcom response matrix and apply the fixed release for each supported branch.
- Do not treat access restriction as a permanent substitute for patching; Broadcom lists no workaround.
- Preserve vCenter, Syslog, identity, network, and virtualization-management logs before they rotate.
- Review unexpected files, services, scheduled activity, administrator changes, API sessions, host operations, and outbound connections.
- Assess credentials, certificates, backup systems, and hypervisor access reachable from vCenter; rotate them if compromise cannot be excluded.
- Verify the running appliance version and management-plane exposure after remediation.
Management note
A compromised virtualization control plane can affect many systems at once. Treat internet-reachable or broadly accessible vCenter instances as an incident-triage priority, not only a patching task.