Glossary term
Ransomware
Ransomware is malware that encrypts files and systems so they become unusable until a ransom is paid.
Read more
Exploited vulnerability
VMware vCenter Syslog flaw (CVE-2026-59310)
CVE-2026-59310
CVE-2026-59310 is a directory traversal flaw in the Syslog server of VMware vCenter, the console used to manage virtualised servers.
- On CISA KEV
- CVE ID
- CVE-2026-59310
- CISA KEV
- Listed
- Affected product
- VMware vCenter
- Exploited
- Yes
- Published
- July 2026
In short
CVE-2026-59310 is a directory traversal flaw in the Syslog server of VMware vCenter, the console used to manage virtualised servers. A directory traversal lets an attacker reach files and folders outside the ones a program intends to expose. CISA lists it as exploited and flags known ransomware campaign use.
- CVECVE-2026-59310
- ProductBroadcom (VMware) VMware vCenter
- CISA KEVListedKnown Exploited Vulnerabilities
- ExploitedYesin real attacks
- Fix Steps4actions listedPatch to the fixed build · Patch the companion flaw too
What it allows
An attacker who can reach vCenter over the network may run arbitrary code on it, with no account needed. Broadcom rates it Critical, CVSS v3 9.8 out of 10, and the NVD record shows the same 9.8 (CVSS v3.1, network, low complexity, no privileges, no user action). Broadcom lists no workaround. vCenter controls the virtual machines of a whole environment, so control of it is control of the hosts below it.
Who is affected
The flaw is fixed in Broadcom advisory VMSA-2026-0006, which also covers a second vCenter flaw, CVE-2026-59309 (authentication bypass in the Directory Service). Fixed versions: vCenter in Cloud Foundation and vSphere Foundation 9.1 needs 9.1.0.0300, and 9.0 needs 9.0.2.0100. Standalone vCenter 8.0 needs 8.0 U3k, or 8.0 U2f for the U2 line. Cloud Foundation 5.x gets an async patch to 8.0 U3k. vCenter 7.0 has a fix only for customers with an extended support contract. Telco Cloud Platform and Infrastructure products use KB449886.
Broadcom published the advisory on 29 July 2026 and last updated it on 19 August 2026. NVD published the record on 30 July 2026. The Broadcom advisory text opened for this page does not say the flaw was exploited.
CISA added CVE-2026-59310 to its Known Exploited Vulnerabilities (KEV) catalog on 18 August 2026, with a due date of 21 August 2026 for US federal agencies. The KEV entry flags known use in ransomware campaigns. The sources opened here do not state when exploitation first began and do not name an actor, so no actor is attributed.
What to do
-
Patch to the fixed build
Move to 9.1.0.0300, 9.0.2.0100, 8.0 U3k or 8.0 U2f as listed in the advisory. There is no workaround, so patching is the only fix. Plan an upgrade path for 7.0 systems without extended support.
-
Patch the companion flaw too
The same update closes CVE-2026-59309, an authentication bypass in vCenter. Treat both as one job and check the fixed-version table for your product line.
-
Limit who can reach vCenter
The attack needs network access to vCenter. Keep management interfaces on a dedicated network, off the internet, and allow only administrator hosts.
-
Detect and hunt
CISA marks this entry for forensic triage, so assume exposed, unpatched servers may already be compromised. Review vCenter and Syslog service logs and look for unexpected files, new accounts and outbound connections from vCenter dating back to before the patch.
Questions
What is CVE-2026-59310?
It is a directory traversal flaw (CWE-22) in the Syslog server of VMware vCenter. An attacker who can reach vCenter over the network may run arbitrary code on it with no account. Broadcom rates it Critical, CVSS 9.8.
Which vCenter versions fix CVE-2026-59310?
Per Broadcom advisory VMSA-2026-0006, fixed builds are 9.1.0.0300, 9.0.2.0100, 8.0 U3k and 8.0 U2f. vCenter 7.0 has a fix only for customers with an extended support contract.
Is there a workaround for CVE-2026-59310?
No. Broadcom lists no workaround, so patching is the only fix. You can also limit who can reach vCenter by keeping management interfaces on a dedicated network, off the internet, open only to administrator hosts.
Is CVE-2026-59310 exploited in the wild?
CISA added it to the Known Exploited Vulnerabilities catalog on 18 August 2026, with a due date of 21 August 2026, and the entry flags known use in ransomware campaigns. The sources opened do not name an actor.
What else should I patch with CVE-2026-59310?
The same update closes CVE-2026-59309, an authentication bypass in the vCenter Directory Service. Treat both as one job and check the fixed-version table in the advisory for your product line.
Sources
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.