{"id":"vmware-vcenter-syslog-traversal-aug-2026","category":"patch","status":"closed","title":"Broadcom VMware vCenter Syslog path traversal (CVE-2026-59310) exploited by spies and ransomware gangs","tldr":"A critical VMware vCenter flaw (CVE-2026-59310) lets an attacker with network access run code. CISA lists it as exploited, including by ransomware gangs. Fixed in 9.1.0.0300, 9.0.2.0100 and 8.0 U3k, with no workaround. Patch now; keep vCenter off the internet.","summary":"Broadcom's VMSA-2026-0006 advisory, published on 29 July 2026, fixed two critical flaws in VMware vCenter, the management console for VMware virtual machine servers. CVE-2026-59310 is a directory traversal flaw in the vCenter Syslog server that can lead to arbitrary code execution by an attacker with network access, rated 9.8. A companion flaw, CVE-2026-59309, is an authentication bypass in the vCenter directory service, also rated 9.8. CISA added CVE-2026-59310 to its exploited-vulnerabilities list on 18 August 2026, and on 15 September said ransomware gangs had joined an existing espionage campaign, according to press reports. Press also links the earlier attacks to a suspected China-linked actor, which Broadcom does not confirm. Broadcom's advisory itself does not say whether the flaws are being exploited. Fixes are vCenter 9.1.0.0300, 9.0.2.0100 and 8.0 U3k; vCenter 7.0 fixes are for extended support customers only. There are no workarounds. This mainly affects organisations running VMware; most families will not.","action":"If you or your family office run VMware vCenter, update to 9.1.0.0300, 9.0.2.0100 or 8.0 U3k now, and make sure vCenter is not reachable from the internet. Ask your IT provider to confirm the build number; if it is vCenter 7.0, contact Broadcom about extended support. Otherwise nothing to do.","product":"Broadcom VMware vCenter Server","audience":"work","severity":"critical","patch":"partial","exploited":true,"cves":["CVE-2026-59310"],"tags":["vmware","vcenter","broadcom","path-traversal","ransomware","exploited","cisa-kev","virtualisation"],"affected":["VMware vCenter 9.1.x below 9.1.0.0300","VMware vCenter 9.0.x below 9.0.2.0100","VMware vCenter 8.0 below 8.0 U3k","VMware vCenter 7.0 (fix only via extended support contact)","VMware Cloud Foundation 5.x","Telco Cloud Platform and Telco Cloud Infrastructure"],"fixed":["9.1.0.0300","9.0.2.0100","8.0 U3k","VCF 5.x: async patch to 8.0 U3k (KB88287)","Telco Cloud: KB449886"],"matches":[],"sources":[{"kind":"advisory","title":"VMSA-2026-0006: VMware ESX, vCenter, Workstation and Fusion security advisory","url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017","by":"Broadcom","date":"2026-08-19"},{"kind":"research","title":"Critical VMware vCenter vulnerabilities allow authentication bypass and remote code execution (CVE-2026-59309, CVE-2026-59310)","url":"https://rapid7.com/blog/post/etr-critical-vmware-vcenter-vulnerabilities-allow-authentication-bypass-and-remote-code-execution-cve-2026-59309-cve-2026-59310","by":"Rapid7","date":"2026-07-30"},{"kind":"news","title":"CISA: VMware vCenter flaw exploited by ransomware gangs, KEV deadline","url":"https://tech-insider.org/cisa-vmware-vcenter-ransomware-gangs-kev-deadline-2026/","by":"Tech Insider","date":"2026-09-15"}],"started":"2026-08-18","closed":"2026-09-15","created":"2026-11-03T21:46:14.700Z","updated":"2026-11-03T21:46:14.700Z","cve_notes":[{"cve":"CVE-2026-59310","name":"Path traversal in VMware vCenter Syslog server","what":"A directory traversal flaw in the vCenter Syslog server that lets an attacker with network access to vCenter run their own code, and which CISA lists as exploited, including by ransomware gangs.","severity":"critical","cvss":9.8}],"timeline":[{"at":"2026-09-15","added":"2026-11-03T21:41:32.717Z","kind":"wider-attacks","text":"CISA said ransomware gangs had joined an already active espionage campaign, per BleepingComputer as relayed by Tech Insider. No ransomware group was named by CISA; a separate firm linked later activity to Babuk-derived ransomware on ESXi hosts.","url":"https://tech-insider.org/cisa-vmware-vcenter-ransomware-gangs-kev-deadline-2026/","by":"Tech Insider","patch":null},{"at":"2026-08-19","added":"2026-11-03T21:41:32.717Z","kind":"vendor-revised","text":"Broadcom revised the advisory (version .2) to add fix guidance for vCenter and ESX 7.0, available to customers with an extended support contract.","url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017","by":"Broadcom","patch":"partial"},{"at":"2026-08-18","added":"2026-11-03T21:41:32.717Z","kind":"cisa-added","text":"CISA added CVE-2026-59310 to its Known Exploited Vulnerabilities list, with a federal agency deadline of 21 August 2026.","url":"https://tech-insider.org/cisa-vmware-vcenter-ransomware-gangs-kev-deadline-2026/","by":"Tech Insider","patch":null},{"at":"2026-08-17","added":"2026-11-03T21:41:32.717Z","kind":"wider-attacks","text":"The Hacker News reported a suspected China-linked actor exploiting CVE-2026-59310 to run commands on vCenter servers, as summarised by Tech Insider. The attribution is the reporters' and is not confirmed by Broadcom, whose advisory does not say the flaws are exploited.","url":"https://tech-insider.org/cisa-vmware-vcenter-ransomware-gangs-kev-deadline-2026/","by":"Tech Insider","patch":null},{"at":"2026-08-03","added":"2026-11-03T21:41:32.717Z","kind":"new-fix","text":"Broadcom revised the advisory (version .1) to add express patches for the older vCenter 8.0 U2f line.","url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017","by":"Broadcom","patch":null},{"at":"2026-07-30","added":"2026-11-03T21:41:32.717Z","kind":"other","text":"Rapid7 published its analysis and said it knew of no exploitation, scanning or public proof-of-concept code at that point.","url":"https://rapid7.com/blog/post/etr-critical-vmware-vcenter-vulnerabilities-allow-authentication-bypass-and-remote-code-execution-cve-2026-59309-cve-2026-59310","by":"Rapid7","patch":null},{"at":"2026-07-29","added":"2026-11-03T21:41:32.717Z","kind":"disclosed","text":"Broadcom published advisory VMSA-2026-0006, covering two critical vCenter flaws (CVE-2026-59309 and CVE-2026-59310) plus ESX, Workstation and Fusion issues. Fixes shipped the same day: vCenter 9.1.0.0300, 9.0.2.0100 and 8.0 U3k. Broadcom lists no workarounds.","url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017","by":"Broadcom","patch":"patched"}],"url":"https://hard.fyi/live/vmware-vcenter-syslog-traversal-aug-2026/","json":"https://hard.fyi/api/live?id=vmware-vcenter-syslog-traversal-aug-2026"}