> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # CVE-2026-59310 — Broadcom VMware vCenter: Broadcom VMware vCenter Path Traversal Vulnerability - URL: https://f4n6.co.uk/security-feed/cve-2026-59310-broadcom-vmware-vcenter-broadcom-vmware-vcenter-path-traversal-vulnerability/ - Published: 2026-08-18T23:09:55.000Z - Updated: 2026-08-18T23:09:55.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-59310 ## 1\. Executive summary CVE-2026-59310 is a critical (CVSS 9.8) path traversal vulnerability (CWE-22) in the Broadcom VMware vCenter Syslog server. It allows an unauthenticated, remote attacker with network access to execute arbitrary code on the vCenter Server. The vulnerability is confirmed in CISA's Known Exploited Vulnerabilities (KEV) catalog (added 2026-08-18) with a remediation due date of 2026-08-21\. Active exploitation in the wild has been reported by multiple security vendors, with suspected China-nexus APT involvement and deployment of Babuk-derived ransomware (single-sourced; verify before enforcement). EMEA financial services running affected vCenter versions face immediate risk of management-plane compromise, enabling full control of virtualized infrastructure and associated workloads. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 19 | Confirmed active exploitation of a CVSS 9.8 vulnerability in vCenter (CISA KEV-listed) with arbitrary code execution on a critical management-plane component constitutes a major ICT-related incident if exploited within a client environment. | Clients must be prepared to classify and report this as a major ICT-related incident to competent authorities if exploitation is confirmed on their infrastructure. | | DORA Art. 24 | CISA KEV inclusion with a 2026-08-21 due date and confirmed in-the-wild exploitation creates a time-bound, risk-prioritised testing obligation for vCenter deployments. | Clients must immediately test for exposure to CVE-2026-59310 across all vCenter assets and prioritise remediation ahead of the KEV deadline. | | NIS2 Art. 23 | Active exploitation of a critical vulnerability in core virtualization infrastructure with confirmed threat actor campaigns triggers incident reporting obligations for in-scope essential/important entities. | NIS2 in-scope organisations must assess whether exploitation has occurred and, if so, meet early (24h) and detailed (72h) reporting timelines. | ## 3\. Technical analysis & attack chain **Vulnerability mechanism:** CVE-2026-59310 is a directory traversal vulnerability in the VMware vCenter Syslog server component. The CVSS 3.1 vector is `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, confirming network-exploitable, unauthenticated, remote code execution with no user interaction required. The attacker traverses directory paths via the Syslog server service to execute arbitrary code on the vCenter Server host. ### Affected versions (from NVD CPE configuration) - VMware vCenter Server 8.0 (all builds up to and including 8.0 Update 3c) - VMware vCenter Server 9.0.x.x (versions from 9.0 up to and excluding 9.0.2.0100) - VMware vCenter Server 9.1.x.x (versions from 9.1 up to and excluding 9.1.0.0300) - VMware Cloud Foundation (vCenter component) 5.x — async patch to 8.0 U3k - VMware Telco Cloud Platform 3.0, 4.x, 5.0.x, 5.1.x — refer to KB449886 - VMware Telco Cloud Infrastructure 3.0 — refer to KB449886 ### Confirmed attack chain 1. **Initial access:** Attacker establishes network access to the vCenter Server's Syslog server service. No prior authentication is required. Management interfaces are commonly restricted to internal networks, but an attacker already present on the network (or with exposure via misconfigured firewalls/VPN) can reach the service. 2. **Path traversal exploitation:** Attacker sends crafted requests to the vCenter Syslog server leveraging directory traversal sequences to escape intended directory boundaries. 3. **Arbitrary code execution:** The traversal allows the attacker to write or execute arbitrary code on the vCenter Server host, achieving remote code execution in the context of the vCenter service. 4. **Management-plane compromise:** With code execution on vCenter, the attacker gains control of the central management plane for the vSphere environment — including ESXi hosts, virtual machines, resource allocation, and availability configurations. 5. **Persistence and lateral movement:** The Hacker News (corpus-1) reports attackers gaining persistent remote access following exploitation. Dark Reading (corpus-4) notes that patching alone may not fully mitigate the threat, implying post-exploitation persistence mechanisms may survive remediation. ### Attribution and ransomware (single-sourced; verify before enforcement) The Hacker News (corpus-5) reports attribution to a suspected China-nexus APT actor and deployment of Babuk-derived ransomware following exploitation. This attribution is drawn from a single vendor report (QUIRSO) and no MITRE ATT&CK profile for the named actor is available in the verified reference data — treat as unconfirmed. The "Babuk-derived ransomware" claim is similarly single-sourced. No specific IOCs, ransom note text, or Babuk variant identifiers are provided in the source material. **Rapid7 (corpus-2) context:** At the time of their initial publication (2026-07-30), Rapid7 reported no known evidence of exploitation or scanning in the wild and no public proof-of-concept exploit code. This contrasts with later reporting (corpus-1, corpus-3, corpus-4, corpus-5) confirming active exploitation — the timeline indicates exploitation began in early August 2026, between the patch release and the CISA KEV addition. ## 4\. Mitigation & containment ### P1 — Within 24 hours 1. **Inventory and exposure assessment:** Identify all VMware vCenter Server deployments (versions 8.0, 9.0.x, 9.1.x) and VMware Cloud Foundation / vSphere Foundation / Telco Cloud environments. Determine whether vCenter Syslog server interfaces are exposed to any network segment accessible beyond dedicated management VLANs. 2. **Network containment:** Restrict access to vCenter Server management interfaces (HTTPS 443, Syslog service) to dedicated management networks only. Implement explicit allow-listing at firewall/EDR layers for vCenter management IP addresses. Verify no vCenter instance is internet-facing. 3. **Begin patching:** Apply Broadcom patches per VMSA-2026-0006 immediately on the most critical vCenter instances. Broadcom states there are **no workarounds** for CVE-2026-59310 — vendor-provided updates are the sole remediation path. - vCenter 8.0 → patch to 8.0 U3k or later - vCenter 9.0.x → update to 9.0.2.0100 or later - vCenter 9.1.x → update to 9.1.0.0300 or later - VMware Cloud Foundation 5.x → async patch to 8.0 U3k - VMware Telco Cloud Platform/Infrastructure → refer to KB449886 ### P2 — Within 72 hours (by CISA KEV due date 2026-08-21) 1. **Complete patching** of all remaining affected vCenter instances across the estate. 2. **Forensic triage:** On any vCenter instance suspected of prior exposure, conduct forensic investigation for signs of compromise — review vCenter service logs, Syslog server logs, unexpected process execution, new local accounts, scheduled tasks, and modifications to vCenter SSO configuration. CISA's "Forensics Triage Requirements" (referenced in the KEV entry) apply. 3. **Post-patch persistence check:** Given Dark Reading's reporting that patching may not fully mitigate the threat (corpus-4), perform a full compromise assessment on any vCenter that was exposed and unpatched for any period after 2026-08-01\. Look for: persistence via vCenter SSO role modifications, new ESXi host additions, modified VM configurations, and any deployed ransomware payloads (Babuk-derived per single-sourced reporting — verify before enforcement). ### P3 — Within 7 days 1. **Validate patch deployment** across all environments including disaster recovery sites and Telco Cloud deployments. 2. **Review segmentation:** Confirm vCenter management networks are isolated from general corporate networks and that VPN/remote access to management segments requires MFA and jump-host access. 3. **Update EDR/monitoring rules** to detect vCenter Syslog server process anomalies and unexpected child processes spawned by the vCenter service account. ## 5\. Indicators of compromise No indicators of compromise available in the source material. ### Behavioural indicators | Behaviour | Where to observe | Confidence | | ------------------------------------------------------------------------------- | ------------------------------------------------------------ | --------------------------------------------------------------------- | | Unexpected outbound network connections from vCenter Server host | EDR, network firewall logs, vCenter host netflow | Medium — consistent with reported persistent remote access (corpus-1) | | Arbitrary code execution originating from vCenter Syslog server service | EDR process tree on vCenter Server host, audit logs | High — directly matches vulnerability mechanism | | New or modified local accounts on vCenter Server | vCenter SSO logs, OS-level account logs on vCenter appliance | Medium — consistent with post-exploitation persistence | | Deployment of Babuk-derived ransomware payloads on vCenter or managed VMs | EDR, file system monitoring, ransom note presence | Low — single-sourced (corpus-5); verify before enforcement | | Modifications to ESXi host configurations or new VM deployments via vCenter API | vCenter task/event logs, vSphere Client audit logs | Medium — consistent with management-plane compromise | ## 6\. Detection Insufficient indicators to author detection rules. ## CVE assessment 1 referenced CVE — **1 actively exploited (CISA KEV)**, 1 critical (CVSS ≥ 9.0) | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | ------------ | ---------------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-59310](https://nvd.nist.gov/vuln/detail/CVE-2026-59310?ref=f4n6.co.uk) | 9.8 Critical | ⚠ KEV 2026-08-18 | 1% | VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCen… | ## 7\. Sources - NVD, CVE-2026-59310 Detail, https://nvd.nist.gov/vuln/detail/CVE-2026-59310, 2026-08-17 - The Hacker News, Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access, https://thehackernews.com/2026/08/attackers-exploit-vmware-vcenter.html, 2026-08 - Rapid7, Critical VMware vCenter Vulnerabilities Allow Authentication Bypass and Remote Code Execution (CVE-2026-59309, CVE-2026-59310), https://www.rapid7.com/blog/post/etr-critical-vmware-vcenter-vulnerabilities-allow-authentication-bypass-and-remote-code-execution-cve-2026-59309-cve-2026-59310, 2026-07-30 - SecurityWeek, Critical VMware vCenter Vulnerability in Attackers' Crosshairs, https://www.securityweek.com/critical-vmware-vcenter-vulnerability-in-attackers-crosshairs/, 2026-08 - Dark Reading, Global Threat Campaign Hits Critical VMware vCenter Flaw, https://www.darkreading.com/vulnerabilities-threats/global-threat-campaign-critical-vmware-vcenter-flaw, 2026-08 - The Hacker News, Suspected China-Nexus Actor Exploits VMware vCenter Flaw, Deploys Babuk-Derived Ransomware, https://thehackernews.com/2026/08/suspected-china-nexus-actor-exploits.html, 2026-08 - BleepingComputer, VMware fixes three critical flaws allowing auth bypass, VM escapes, https://www.bleepingcomputer.com/news/security/vmware-fixes-three-critical-flaws-allowing-auth-bypass-vm-escapes/, 2026-07 ## 8\. Adverse Trace position CVE-2026-59310 is a CVSS 9.8 CRITICAL vulnerability with confirmed CISA KEV listing (added 2026-08-18, due 2026-08-21) and corroborated active exploitation across multiple independent sources. The attack surface is significant: unauthenticated, network-exploitable RCE on the vCenter management plane gives an attacker full control of virtualized infrastructure. EMEA financial services clients running vCenter 8.0, 9.0.x, or 9.1.x must treat this as a P1 emergency — patch all instances by 2026-08-21 and conduct forensic triage on any instance that was exposed and unpatched since early August 2026\. The suspected China-nexus APT attribution and Babuk-derived ransomware deployment are single-sourced from one vendor report (QUIRSO via The Hacker News) with no MITRE ATT&CK profile available — treat as unconfirmed but factor into threat modelling. We will monitor for additional IOCs, confirmed attribution, and any public proof-of-concept code, and will update this advisory if the threat picture materially changes. --- [Read the original source →](https://nvd.nist.gov/vuln/detail/CVE-2026-59310?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*