CVE-2026-59310 — VMware vCenter Directory Traversal
CVE-2026-59310 is a directory-traversal vulnerability in Broadcom VMware vCenter Server, rated CVSS 9.8. A malicious actor with network access can exploit it to execute arbitrary code on the management server, and threat actors have begun actively exploiting it for persistent remote access to vCenter management infrastructure, per researcher telemetry from QUIRSO.
Vulnerability Details
| Attribute | Detail |
|---|---|
| CVE | CVE-2026-59310 |
| Type | Directory traversal leading to remote code execution |
| Product | Broadcom VMware vCenter Server |
| CVSS | 9.8 (Critical) |
| Access | Network (unauthenticated per vendor severity) |
| Exploitation status | Exploited in the wild (QUIRSO telemetry, disclosed 2026-08-12) |
| Remediation | Patches shipped by Broadcom; apply immediately to reachable vCenter instances |
Context
vCenter is the control plane for VMware virtualised estates, making this a high-value target: persistent access to vCenter effectively means persistent access to every workload on the platform. The disclosure follows the week's theme of internet-exposed management surfaces being the dominant attack surface (alongside the afd.sys zero-day and Fortinet appliance targeting). Australian and NZ organisations running vCenter should treat this as an urgent patch — unpatched management consoles are a classic first step in ransomware and data-theft operations.
Escalation — 16 September 2026: ransomware gangs join the exploitation
CISA has updated its Known Exploited Vulnerabilities entry for CVE-2026-59310 to record that ransomware gangs are now among those exploiting it, a second escalation of the same identifier after the catalogue addition itself on 18 August ordered US federal agencies to secure their vCenter systems within three days.
The exploitation timeline is now: patch released by Broadcom on 29 July, with a supplemental FAQ telling customers to treat remediation as an emergency; more than 361 IP addresses across 47 countries compromised by early August per QUIRSO telemetry, with a reverse SSH tool used for persistence and remote access; KEV listing on 18 August; and ransomware-campaign attribution by mid-September. CISA has not published which groups are involved or which victims have been hit. Internet monitor Shadowserver currently tracks more than 450 VMware vCenter servers reachable from the internet, with no public information on how many have been patched.
The exposure argument is unchanged and, if anything, sharper: vCenter is the control plane for a virtualised estate, which is why multiple ransomware families maintain dedicated ESXi encryptors. Organisations with an unpatched vCenter Syslog endpoint should treat the flaw as exploited rather than merely exposed.
Related Pages
- Lazarus Exploits Windows Zero Day To Gain System Access And Deploy Backdoor — the same week's zero-day exploitation trend
- Cve 2026 68820 Afd Sys Winsock Uaf — afd.sys WinSock zero-day
Sources: raw/digests/Cyber-Digest-2026-08-13.md; raw/digests/Cyber-Digest-2026-09-16.md