CVE-2026-59309

vCenter authentication-bypass vulnerability

No known exploitation. EPSS puts it in the 47th percentile. A vendor fix is available.

CVSS 3.19.8Critical EPSS percentile47th0.6% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-07-30Updated 2026-08-25Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether you run VMware vCenter (and the related products: Cloud Foundation, vSphere Foundation, Telco Cloud Infrastructure, Telco Cloud Platform) and determine your exact vCenter version.
Check whether the VMware Directory Service is exposed to the network (especially from the internet) and whether it is reachable from outside your internal network.
If you are on a vulnerable vCenter version, upgrade to one of the fixed releases: vCenter 9.1.0.0300, 9.0.2.0100, or 8.0 U3k.
If you cannot upgrade immediately, restrict network access so the Directory Service is not reachable from untrusted networks, then confirm reachability is blocked.

Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized access to the system.

In plain language

Written by AI from the record

CVE-2026-59309 is a VMware vCenter login-bypass flaw that lets an attacker get full control from the network without credentials; a typical small business should treat any internet- or network-exposed vCenter as an urgent risk.

Unauthenticated authentication-bypass (CWE-303) in the VMware Directory Service component of VMware vCenter allows an attacker with network access to bypass login and gain unauthorized administrative/full system access.

If you're affected

Full vCenter takeover
Widespread service outage risk
Ransomware deployment risk
Loss of control over VMs

What is it

This is a flaw that breaks the “login wall” for VMware vCenter. In plain terms, an attacker who can reach the right network service can skip authentication and gain administrator-level control, which can then allow them to take over your virtual machines and disrupt operations—similar to stealing the keys to your building through a door that was supposed to lock automatically.

Who is affected

This matters if your business uses VMware vCenter (including the related offerings listed: Cloud Foundation, vSphere Foundation, Telco Cloud Infrastructure, Telco Cloud Platform). The risk is specifically for systems where the VMware Directory Service is exposed to the network and the vCenter version is vulnerable.

If the Directory Service isn’t reachable from the network you allow (especially the internet), the risk may be much lower; this issue is a network-reachable, unauthenticated bypass.

How urgent is it

This is RED because the vulnerability allows remote attackers to bypass authentication and obtain full control without valid credentials. Additionally, press activity indicates sustained exploitation activity in the broader VMware environment during this timeframe (though not specifically confirmed for this exact CVE).

Treat this as an immediate patch-and-restrict situation if your vCenter Directory Service is reachable from untrusted networks.

What to do — in detail

Confirm exposure scope
- Identify whether you run VMware vCenter as part of Cloud Foundation, vSphere Foundation, Telco Cloud Infrastructure, or Telco Cloud Platform.
- Record the exact vCenter version you are running.
Determine whether the vulnerable component is reachable
- From a security/IT standpoint, verify whether the VMware Directory Service (part of vCenter) is reachable from outside your internal network.
- Concretely: test/verify firewall rules and routing so that only approved internal sources can reach the required vCenter/Directory Service network endpoints.
Verify whether you are on a fixed version
- Apply the fixed-version guidance from the findings:
  - vCenter fixed in 9.1.0.0300, OR
  - vCenter fixed in 9.0.2.0100, OR
  - vCenter fixed in 8.0 U3k.
- If your version is earlier than these fixed releases, treat your environment as vulnerable until patched.
Upgrade plan (preferred remediation)
- Upgrade vCenter to the fixed version(s) above (choose the one that matches your environment and supported upgrade path).
- Plan for a maintenance window appropriate for your vCenter upgrade procedure and validate post-upgrade services.
Temporary containment if you can’t upgrade immediately
- Restrict network access so the VMware Directory Service is not reachable from untrusted networks (for example, no direct internet reachability).
- After changes, re-test reachability from outside the trusted network to confirm access is blocked.
What to monitor after changes
- Monitor vCenter and network logs for authentication-bypass-like patterns (unexpected administrative actions, abnormal login/auth events, or unusual request patterns to vCenter Directory Service endpoints).
- Review any firewall/NAT logs for connections coming from unexpected external IP ranges during the window before containment/patching.

Technical context

Severity is effectively critical (CVSS 9.8 indicated in the prompt) because the issue is an unauthenticated authentication-bypass (CWE-303) reachable over the network, with no user interaction required, and it can lead to loss of confidentiality, integrity, and availability.

Mechanism: an attacker with network access can bypass authentication on the VMware Directory Service within VMware vCenter and gain unauthorized administrative or full system access.

Exploitation status from findings: KEV is not listed, and there is no public exploit code on record. News/press in the provided findings discusses active exploitation of CVE-2026-59310 (not this CVE), but it also indicates sustained exploitation activity in the broader context involving Babuk; no dated, CVE-2026-59309-specific exploitation claim was identified in the provided sources.

EPSS is provided as a prediction and should not be treated as confirmed exploitation evidence.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS47th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.6% chance of exploitation activity in the next 30 days, which ranks it in the 47th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

8 events over 26 days, from the signal feeds we watch.

2026-08-25Patch availablerecord updated
2026-08-11Analysis publishedBroadcom's VMSA-2026-0006 Patches Three Critical VMware Flaws — vCenter Has Failed This Exact Way Before
2026-08-01OpenVAS check added
2026-07-30Publishedweakness classified, record updated, record updated

Affected products

VMwarecommercial · USaka vmware inc
- Cloud FoundationSaaS ServiceSaaSCloud & SaaS / cloud-platform
- vSphere FoundationOn-premCloud & SaaS / virtualization
- vCenterOn-premCloud & SaaS / cloud-platform
- Telco Cloud InfrastructureSaaS ServiceSaaSCloud & SaaS / cloud-platform
- Telco Cloud PlatformSaaS ServiceSaaSCloud & SaaS / cloud-platform
- vcenter serverSaaS ServiceSaaSCloud & SaaS / container-orchestration

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable

Weaknesses

CWE-303No name in the record

Sources

References in the record

support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017

In the news

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Cloud Foundation, not every advisory.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account