CVE-2026-59310
vCenter directory-traversal vulnerability
Exploited in the wild. In CISA KEV since 2026‑08‑18. A vendor fix is available.
What to do
The vendor has published a fix. Version details are below where the sources state them.
Steps
Written by AI from the record- Check your VMware vCenter version and confirm whether the Syslog server is reachable from any untrusted network (e.g., not strictly limited to your admin networks).
- If you are on vCenter, plan an upgrade to a fixed release: vCenter 9.1.0.0300, or vCenter 9.0.2.0100, or vCenter 8.0 U3k (whichever matches your current major version).
- Restrict network access to the vCenter Syslog server from the internet or broader networks (allow only required sources, such as your logging collectors/admin hosts).
- After changes, monitor vCenter and appliance logs for unusual Syslog-related errors and unexpected process activity, and verify the service behavior matches normal operation.
What it is
From the CVE record
VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.
In plain language
Written by AI from the recordThis is a directory-traversal weakness in VMware vCenter’s Syslog server that can let an attacker with network access break into the system and potentially run code—small businesses using vCenter should treat it as urgent.
CVE-2026-59310 is a directory-traversal issue (CWE-22) in the VMware vCenter Syslog server that can be exploited by a network-reachable attacker to write or access unintended paths and ultimately achieve arbitrary code execution; sustained press attention attributes exploitation activity to an APT actor.
If you're affected
- Full vCenter compromise
- Malware persistence risk
- Service disruption or outage
- Potential takeover of management control
Exploitation
Where each signal puts this CVE on the scale from published to confirmed exploited.
- CISA KEV
Listed as exploited in the wild since 2026-08-18.
US federal agencies must remediate by 2026-08-21.
Known use in ransomware campaigns.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Public exploits
No public exploit or proof of concept found in the sources we track.
- EPSS
2.6% chance of exploitation activity in the next 30 days, which ranks it in the 84th percentile of scored CVEs.
Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.
- Attention now
Rising.
Real risk signals with little public attention so far.
Lifecycle
21 events over 56 days, from the signal feeds we watch.
- EPSS band changehigh → lowepss band change
- EPSS band changemoderate → highepss band change
- EPSS band change0 → moderateepss band change
- Patch availablerecord updated
- Added to CISA KEVpatch available, record updated
- Record updated
Affected products
Technical detail
CVSS 3.1 vector
Open in the CVSS calculatorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Scored 9.8 by NVD.
How it is reached
- Attack Vector NetworkExploitable remotely over the network without any special conditions
- Attack Complexity LowNo special conditions — the attack can be reliably reproduced
- Privileges Required NoneNo authentication required — anyone can exploit this
- User Interaction NoneNo user interaction needed — fully automated exploitation
Scope
- Scope UnchangedImpact is limited to the vulnerable component itself
Impact if exploited
- Confidentiality HighTotal information disclosure — all data in the component is compromised
- Integrity HighTotal loss of integrity — attacker can modify any data in the component
- Availability HighTotal denial of service — the component is completely unavailable
Weaknesses
ATT&CK techniques
Mapped from the weaknesses above (CWE to ATT&CK), not observed in attacks.
Sources
References in the record
- support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017
- medium.com/@quirso_de/active-exploitation-of-cve-2026-59310-361-victim-ips-across-47-countries-9783187cc6ff
- medium.com/@quirso_de/global-exploitation-of-cve-2026-59310-by-suspected-chinese-nexus-apt-related-cve-2026-59309-443a79e1466d
And 1 more reference. See all after sign-in
In the news
All news- ThreatsDay: Self-Rewriting Agents, 800+ Flaws Patched, Insider SIM Swaps and 22 More New Stories
- CISA: Critical VMware RCE flaw now exploited by ransomware gangs
- Critical VMware Workstation and Fusion Flaw Lets VM Admins Execute Host Code
- Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation
- CISA Urges Immediate Patching of Exploited Microsoft, VMware, Apple Vulnerabilities
- ⚡ Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and More
- Suspected China-Nexus Actor Exploits VMware vCenter Flaw, Deploys Babuk-Derived Ransomware
- Global Threat Campaign Hits Critical VMware vCenter Flaw
- Critical VMware vCenter RCE flaw exploited for reverse SSH access
- Critical VMware vCenter Vulnerability in Attackers’ Crosshairs
Watch the software you run.
My Stack ranks new CVEs for your products by real-world exploitation, so the next exploited one reaches you without reading every advisory.
We'll flag the next CVE, public exploit or patch for Vcenter Server, not every advisory. This one: actively exploited.
A free account adds
- The full version matrix and every affected product
- Exploit links, proofs of concept and Metasploit modules
- Email alerts for the products you watch
- The same data over REST API, MCP and CLI