Broadcom VMware vCenter Syslog path traversal (CVE-2026-59310) exploited by spies and ransomware gangs
A critical VMware vCenter flaw (CVE-2026-59310) lets an attacker with network access run code. CISA lists it as exploited, including by ransomware gangs. Fixed in 9.1.0.0300, 9.0.2.0100 and 8.0 U3k, with no workaround. Patch now; keep vCenter off the internet.
If you or your family office run VMware vCenter, update to 9.1.0.0300, 9.0.2.0100 or 8.0 U3k now, and make sure vCenter is not reachable from the internet. Ask your IT provider to confirm the build number; if it is vCenter 7.0, contact Broadcom about extended support. Otherwise nothing to do.
What’s happening
Broadcom's VMSA-2026-0006 advisory, published on 29 July 2026, fixed two critical flaws in VMware vCenter, the management console for VMware virtual machine servers. CVE-2026-59310 is a directory traversal flaw in the vCenter Syslog server that can lead to arbitrary code execution by an attacker with network access, rated 9.8. A companion flaw, CVE-2026-59309, is an authentication bypass in the vCenter directory service, also rated 9.8. CISA added CVE-2026-59310 to its exploited-vulnerabilities list on 18 August 2026, and on 15 September said ransomware gangs had joined an existing espionage campaign, according to press reports. Press also links the earlier attacks to a suspected China-linked actor, which Broadcom does not confirm. Broadcom's advisory itself does not say whether the flaws are being exploited. Fixes are vCenter 9.1.0.0300, 9.0.2.0100 and 8.0 U3k; vCenter 7.0 fixes are for extended support customers only. There are no workarounds. This mainly affects organisations running VMware; most families will not.
- What
- Flaw
- Affects
- Broadcom VMware vCenter Server
- Affected
- VMware vCenter 9.1.x below 9.1.0.0300
VMware vCenter 9.0.x below 9.0.2.0100
VMware vCenter 8.0 below 8.0 U3k
VMware vCenter 7.0 (fix only via extended support contact)
VMware Cloud Foundation 5.x
Telco Cloud Platform and Telco Cloud Infrastructure - Fixed in
- 9.1.0.0300
9.0.2.0100
8.0 U3k
VCF 5.x: async patch to 8.0 U3k (KB88287)
Telco Cloud: KB449886 - Since
- 18 Aug 2026
- Closed
- 15 Sept 2026
Timeline
- Wider attacks
CISA said ransomware gangs had joined an already active espionage campaign, per BleepingComputer as relayed by Tech Insider. No ransomware group was named by CISA; a separate firm linked later activity to Babuk-derived ransomware on ESXi hosts.
- Vendor revisedPartly fixed
Broadcom revised the advisory (version .2) to add fix guidance for vCenter and ESX 7.0, available to customers with an extended support contract.
- CISA added
CISA added CVE-2026-59310 to its Known Exploited Vulnerabilities list, with a federal agency deadline of 21 August 2026.
- Wider attacks
The Hacker News reported a suspected China-linked actor exploiting CVE-2026-59310 to run commands on vCenter servers, as summarised by Tech Insider. The attribution is the reporters' and is not confirmed by Broadcom, whose advisory does not say the flaws are exploited.
- New fix
Broadcom revised the advisory (version .1) to add express patches for the older vCenter 8.0 U2f line.
- Update
Rapid7 published its analysis and said it knew of no exploitation, scanning or public proof-of-concept code at that point.
- Made publicFixed
Broadcom published advisory VMSA-2026-0006, covering two critical vCenter flaws (CVE-2026-59309 and CVE-2026-59310) plus ESX, Workstation and Fusion issues. Fixes shipped the same day: vCenter 9.1.0.0300, 9.0.2.0100 and 8.0 U3k. Broadcom lists no workarounds.
Sources
- VMSA-2026-0006: VMware ESX, vCenter, Workstation and Fusion security advisoryBroadcom · 19 Aug 2026
- Critical VMware vCenter vulnerabilities allow authentication bypass and remote code execution (CVE-2026-59309, CVE-2026-59310)Rapid7 · 30 July 2026
- CISA: VMware vCenter flaw exploited by ransomware gangs, KEV deadlineTech Insider · 15 Sept 2026