Critical VMware vCenter Vulnerabilities Allow Authentication Bypass and Remote Code Execution (CVE-2026-59309, CVE-2026-59310)

1. Executive summary

On July 29, 2026, Broadcom published security advisory VMSA-2026-0006 addressing two critical, remotely exploitable vulnerabilities in VMware vCenter Server: CVE-2026-59309 (CVSS 9.8, CRITICAL) and CVE-2026-59310 (CVSS 9.8, CRITICAL). Neither CVE is currently listed in CISA KEV, and there is no evidence of exploitation or public proof-of-concept code at time of publication. Both flaws are exploitable by unauthenticated attackers with network access to vCenter services; successful exploitation enables authentication bypass to the management plane (CVE-2026-59309) and arbitrary remote code execution (CVE-2026-59310). EMEA financial services running affected vCenter versions face risk of full virtualization-infrastructure compromise if management networks are breached.

2. Regulatory framing

3. Technical analysis & attack chain

Affected products and versions (from VMSA-2026-0006)

CVE-2026-59309 — CVSS 9.8 CRITICAL — CWE-303 — NOT in CISA KEV

Authentication bypass vulnerability in the VMware Directory Service (vmdir) component of vCenter Server. An unauthenticated remote attacker with network access to a vulnerable vCenter Server can bypass authentication and gain unauthorised access to the vCenter management plane. This provides the attacker with administrative control over ESXi hosts, virtual machines, resource allocation, and availability configurations managed by that vCenter instance.

CVE-2026-59310 — CVSS 9.8 CRITICAL — CWE-22 (Path Traversal) — NOT in CISA KEV

Directory traversal vulnerability in the vCenter Syslog server. An unauthenticated remote attacker with network access to the affected vCenter services can exploit the path traversal to execute arbitrary code on the vCenter Server. This grants the attacker code execution on the vCenter appliance itself, which can be leveraged for full compromise of the virtualization management layer.

Confirmed attack chain

1. Initial access — Attacker requires network access to the vulnerable vCenter Server services. No prior authentication is needed for either vulnerability. Management interfaces are commonly restricted to internal or dedicated management networks, reducing internet exposure but not mitigating risk from an attacker already present on the internal network.
2. Exploitation path A (CVE-2026-59309) — Attacker targets the VMware Directory Service to bypass authentication, gaining unauthorised access to the vCenter management plane without credentials.
3. Exploitation path B (CVE-2026-59310) — Attacker targets the vCenter Syslog server with a directory traversal payload, achieving arbitrary code execution on the vCenter Server.
4. Post-compromise impact — vCenter Server provides centralised management for vSphere environments. Compromise gives the attacker significant control over the virtualized environment and its associated workloads, including ESXi hosts, VMs, resource allocation, and availability settings.

Confidence caveat: All technical detail above is single-sourced, drawn from the Rapid7 blog post referencing Broadcom's VMSA-2026-0006 advisory. The source does not provide specific exploit payloads, protocol details, port numbers, file paths, or post-exploitation techniques. No named threat actor is associated with these vulnerabilities; no MITRE ATT&CK profile is available. No exploitation or scanning activity has been observed in the wild at time of publication.

4. Mitigation & containment

Broadcom states there are no workarounds for CVE-2026-59309 or CVE-2026-59310. Vendor-provided updates are the primary remediation.

P1 — Within 24 hours

• Inventory and assess exposure: Identify all vCenter Server deployments across the estate, including Cloud Foundation, vSphere Foundation, and Telco Cloud Platform/Infrastructure deployments. Cross-reference versions against the affected versions table in §3.
• Restrict network access: Confirm that vCenter management interfaces (including the VMware Directory Service on port 389/636 and the Syslog service) are isolated to dedicated management networks with strict ACLs. Block all inbound access from non-management network segments. If vCenter is internet-exposed, remove exposure immediately.
• Patch VMware Cloud Foundation (vCenter 5.x): Apply the async patch to 8.0 U3k as specified in VMSA-2026-0006.
• Patch VMware Telco Cloud Platform and Telco Cloud Infrastructure: Refer to Broadcom KB449886 for version-specific remediation guidance.

P2 — Within 72 hours

• Patch all remaining affected vCenter versions: Apply vendor-provided updates for vCenter 9.1.x.x, 9.0.x.x, and 8.0 deployments. Consult VMSA-2026-0006 for the specific fixed-version downloads.
• Validate patch application: Confirm vCenter services restart cleanly post-update and that the VMware Directory Service and Syslog server components reflect the patched versions.

P3 — Within 7 days

• Run vulnerability validation: Use unauthenticated vulnerability checks (available in Rapid7 InsightVM, Nexpose, and Exposure Command from July 30 content release) to confirm remediation across all vCenter instances.
• Review management network segmentation: Ensure vCenter, ESXi host management interfaces, and related infrastructure services are on isolated VLANs with east-west traffic monitoring. This limits the blast radius of future vCenter vulnerabilities.
• Update third-party risk records: Reflect VMSA-2026-0006 in Broadcom/vendor risk management documentation, including patch attestation from any managed service providers operating vCenter on the client's behalf.

5. Indicators of compromise

No indicators of compromise available in the source material. No exploitation has been observed in the wild, and no proof-of-concept code has been published. The source does not describe specific behavioural patterns associated with exploitation of these vulnerabilities.

6. Detection

Insufficient indicators to author detection rules. The source material does not contain exploit artefacts, distinctive strings, command-line flags, file paths, registry keys, or network indicators specific to exploitation of CVE-2026-59309 or CVE-2026-59310. No PoC code or observed-exploitation detail is available.

General detection guidance: monitor vCenter Server logs for anomalous authentication events against the VMware Directory Service (vmdir) and unexpected file access patterns or process execution originating from the Syslog service component. These are generic recommendations based on the vulnerability descriptions, not source-confirmed indicators.

CVE assessment

2 referenced CVEs — 2 critical (CVSS ≥ 9.0)

7. Sources

• Rapid7, "Critical VMware vCenter Vulnerabilities Allow Authentication Bypass and Remote Code Execution (CVE-2026-59309, CVE-2026-59310)", https://www.rapid7.com/blog/post/etr-critical-vmware-vcenter-vulnerabilities-allow-authentication-bypass-and-remote-code-execution-cve-2026-59309-cve-2026-59310, published 2026-07-30.

8. Adverse Trace position

Both CVE-2026-59309 and CVE-2026-59310 are rated CVSS 9.8 CRITICAL by the verified reference data and present a severe risk to EMEA financial services organisations running affected VMware vCenter Server versions. Neither vulnerability is in CISA KEV and no in-the-wild exploitation has been observed, but vCenter has historically been a high-value target — it has appeared on CISA's KEV list ten times for prior vulnerabilities. The absence of workarounds means patching is the only remediation path. Clients should treat this as a P1 remediation task: inventory all vCenter instances, restrict management network exposure, and apply vendor patches per VMSA-2026-0006 on an urgent basis. Adverse Trace will monitor for emergence of PoC code, KEV addition, or observed exploitation and will issue an update if the threat landscape changes. All technical detail in this advisory is single-sourced from Rapid7's analysis of the Broadcom advisory; clients should cross-reference VMSA-2026-0006 directly before enforcement.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.