VMware vCenter RCE Flaw CVE-2026-59310: Patch Now

CVE-2026-59310 is a critical, unauthenticated directory-traversal flaw in the Syslog server component of VMware vCenter Server that lets a remote attacker with no credentials execute arbitrary code on the appliance. Broadcom rates it 9.8 out of 10 on the CVSS v3.1 scale and published the fix in VMSA-2026-0006 on July 29, 2026. There is no workaround. The Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on August 18, 2026, flagging known ransomware use and setting one of the shortest remediation windows the catalog assigns. If you run vCenter Server and have not applied the July 2026 patches, treat this as an emergency change: patch now.

What is CVE-2026-59310?

CVE-2026-59310 is a directory-traversal vulnerability in the Syslog server that runs as part of VMware vCenter Server, the management plane that administers clusters of ESX hosts and virtual machines. According to Broadcom's advisory and the National Vulnerability Database (NVD) entry for CVE-2026-59310, an attacker who can reach the vCenter Syslog listener over the network, with no authentication at all, can send crafted input that escapes the intended logging directory and ultimately results in arbitrary code execution on the vCenter appliance. NVD assigns it CWE-22 (Path Traversal) and a CVSS v3.1 base score of 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and full compromise of confidentiality, integrity, and availability.

In practice, that combination of properties is about as severe as a vulnerability rating gets. vCenter typically has broad administrative reach over an organization's entire virtualization estate, so remote code execution on the vCenter appliance itself can translate into control over every VM, host, and datastore that vCenter manages.

Why this matters right now

vCenter Server is core infrastructure for most VMware-based private clouds and data centers. It is also, by design, reachable from inside corporate networks and, in a worrying number of real-world deployments, exposed directly to the internet for remote management. A critical, unauthenticated, network-exploitable flaw in a component like this is the kind of bug that attackers specifically hunt for, because a single successful exploitation can hand over an entire virtualized environment rather than one server.

Broadcom's advisory lists CVE-2026-59310 as having no mitigation path other than upgrading to a fixed build. There is no configuration change, firewall rule, or feature toggle that Broadcom documents as sufficient to neutralize the flaw short of patching. That, combined with the KEV listing and reports of in-the-wild exploitation, is why this has moved from "patch on your normal cycle" to "patch now" for anyone running an affected vCenter version.

Is CVE-2026-59310 being exploited in the wild?

Yes, according to CISA's KEV catalog, which lists CVE-2026-59310 with a known-ransomware-use flag and a required-action note directing agencies to apply Broadcom's fix and follow federal patching directives. Broadcom's own advisory text does not itself describe in-the-wild exploitation at the time of initial publication; the vulnerabilities were reported to Broadcom privately by external researchers before CISA's KEV addition.

Beyond the KEV listing, independent security researchers have published reports describing widescale scanning and compromise of internet-facing vCenter servers, with figures in the hundreds of victim IP addresses spread across dozens of countries, and descriptions of attackers deploying the open-source reverse_ssh tool to maintain persistent remote access after exploitation, in some cases alongside ransomware deployment on connected ESX hosts. Those specific figures and tooling details come from third-party research write-ups rather than from Broadcom, NVD, or CISA directly, so treat the precise victim count, the exact start date of exploitation, and the reverse_ssh detail as reported by outside researchers and not independently confirmed by the vendor or by US government sources. What CISA's KEV entry does independently corroborate is that exploitation is real and that it has been tied to ransomware activity, which is the basis for the catalog's unusually short remediation deadline.

CVE-2026-59309: a related flaw, but is it required for the RCE?

Broadcom disclosed CVE-2026-59309 in the same VMSA-2026-0006 advisory as CVE-2026-59310. CVE-2026-59309 is an authentication bypass in the VMware Directory Service, the component of vCenter that handles identity and access, and it also carries a 9.8 CVSS v3.1 score with the identical vector string to CVE-2026-59310: network-exploitable, low complexity, no privileges, no user interaction, full impact across confidentiality, integrity, and availability.

Whether an attacker needs to chain CVE-2026-59309 with CVE-2026-59310 to achieve remote code execution, or whether CVE-2026-59310 is independently exploitable on its own as an unauthenticated flaw, is disputed and not resolved by Broadcom's own advisory. Broadcom's published text describes each CVE separately and does not state that CVE-2026-59310 depends on CVE-2026-59309, nor does it explicitly rule a dependency out. NVD's own reference links for CVE-2026-59310 point to third-party researcher write-ups that describe the two flaws as "related" and discuss them together in the context of the same exploitation campaign, but that framing comes from outside researchers, not from Broadcom or NVD's own description fields. Given that ambiguity, the safest operational assumption is to patch both CVEs together, since the same fixed vCenter builds resolve both issues simultaneously.

Affected vCenter versions and fixed builds

Per Broadcom's VMSA-2026-0006 advisory, the following vCenter Server release lines are affected by CVE-2026-59309 and CVE-2026-59310, with the listed builds marking the first version where both are resolved:

If your deployment sits on an older vCenter release that is not listed with a direct fixed build, Broadcom's guidance is to contact support for an upgrade path rather than assume the flaw does not apply.

The CISA KEV listing and the federal deadline

CISA's Known Exploited Vulnerabilities catalog added CVE-2026-59310 on August 18, 2026, as the "Broadcom VMware vCenter Path Traversal Vulnerability," with a due date of August 21, 2026, for the US federal civilian agencies that are bound by the KEV catalog's Binding Operational Directive requirements. That is an unusually compressed window compared to the catalog's standard patching timelines, which CISA generally reserves for vulnerabilities it has flagged with known ransomware campaign use, as it has done here. CISA's required-action notes also call for forensic triage consistent with the agency's BOD 26-04 guidance, and direct agencies that cannot patch in time to assess internet exposure and consider taking the affected service offline.

The KEV catalog's deadlines are legally binding only on federal civilian executive branch agencies, but CISA has repeatedly urged every organization, public and private, to treat KEV entries as a prioritization signal and patch on the same accelerated timeline regardless of sector.

Is there a workaround?

No. Broadcom's advisory lists "Workaround: None" for CVE-2026-59310 (and for CVE-2026-59309, and for every other CVE covered in VMSA-2026-0006). There is no documented firewall rule, feature flag, or configuration change from Broadcom that substitutes for installing the fixed build. Restricting network access to the vCenter Syslog listener and to the vCenter management interfaces generally is good defense-in-depth practice and may reduce exposure while a patch window is scheduled, but Broadcom does not list that as a substitute mitigation, and given that the flaw is unauthenticated and network-reachable, any remaining exposed listener should be treated as unresolved risk until the appliance is actually upgraded.

How to check whether your vCenter may already be compromised

Because CVE-2026-59310 has a confirmed KEV listing with known ransomware use, any internet-facing or otherwise broadly reachable vCenter appliance that was running an unpatched build before you apply the fix should be treated as a possible compromise, not just a vulnerability to close. Practical steps consistent with CISA's required forensic-triage guidance for KEV entries with ransomware flags include reviewing vCenter and Syslog server logs for anomalous entries predating your patch, checking for unexpected outbound SSH connections or new scheduled tasks and services on the vCenter appliance, and looking for unfamiliar local accounts or changes to the VMware Directory Service that line up with the kind of authentication-bypass behavior described for CVE-2026-59309. Security researchers have also described attackers establishing persistence with the open-source reverse_ssh tool after exploiting these flaws, a persistence pattern similar to the remote-access tooling used to build and maintain botnets of compromised servers; while the reverse_ssh detail has not been independently confirmed by Broadcom, NVD, or CISA, it is a reasonable indicator to add to a hunt if you suspect prior compromise. If you find evidence of compromise, isolate the appliance from the network, preserve logs and disk images before rebuilding, and engage incident-response resources rather than simply patching in place, since patching alone does not remove an attacker who already established persistent access.

A different VMware flaw, not this one

It is worth separating CVE-2026-59310 clearly from a different, unrelated VMware disclosure covering CVE-2026-41709, an insufficient-logging flaw in VMware ESX that Broadcom also addressed, and that CISA separately added to the KEV catalog around the same general period. CVE-2026-41709 is a low-severity logging gap on ESX hosts that lets a malicious administrator perform certain operations without them being recorded; it has nothing to do with the Syslog-server path-traversal RCE discussed here. If you are triaging multiple VMware KEV entries at once, make sure your patch tracking distinguishes the two by CVE number and component, not just by "VMware."

What to do now

1. Identify every vCenter Server instance in your environment, including any that may be managed outside your primary IT asset inventory, such as those run by business units, labs, or managed service providers on your behalf.
2. Check the installed build number against Broadcom's fixed-build table above, for both CVE-2026-59309 and CVE-2026-59310.
3. Patch to the fixed build immediately on any instance that is below the listed version, prioritizing anything reachable from the internet or from untrusted network segments.
4. Treat pre-patch exposure as a possible compromise given the confirmed KEV ransomware flag, and run the log and persistence checks described above before considering the appliance clean.
5. Restrict network reachability to vCenter's management interfaces and Syslog listener as a defense-in-depth measure while patch windows are being scheduled, understanding this is not a substitute for patching.
6. Track both CVE-2026-59310 and CVE-2026-59309 together in your vulnerability management system, since they share the same fixed builds and advisory, even though Broadcom has not confirmed whether they must be chained to achieve code execution.

vCenter underpins the virtualization layer for a large share of enterprise data centers, a role summarized on Wikipedia's overview of vCenter Server and its place in the broader VMware vSphere platform. A compromise at this layer is rarely contained to a single application; it is a foothold into everything vCenter manages. That is the whole reason CVE-2026-59310 carries a maximum-severity rating, a KEV listing, and a three-day federal deadline, and it is why, if you have not already applied Broadcom's July 2026 vCenter patches, the single most important action from this article is simply: patch now.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage