Directory Traversal Vulnerability in VMware vCenter by VMware
CVE-2026-59310
Key Information:
- Vendor
Vmware
- Vendor
- CVE Published:
- 30 July 2026
Badges
What is CVE-2026-59310?
CVE-2026-59310 is a severe directory traversal vulnerability identified in VMware vCenter, a centralized platform for managing VMware hypervisors and virtual machines. This vulnerability exists in the Syslog server component of vCenter, allowing a malicious actor with network access to potentially execute arbitrary code on the affected systems. Such code execution could lead to unauthorized access to sensitive data, manipulation of system configurations, or even complete control over the virtualized environment. Given that vCenter manages multiple virtual machines and critical organizational workloads, exploitation of this vulnerability can severely compromise an organization’s IT infrastructure, leading to operational disruption and significant security risks.
Potential impact of CVE-2026-59310
-
Arbitrary Code Execution: The most immediate concern is the ability for attackers to execute arbitrary code on the vCenter server. This could allow them to deploy malware, establish backdoors, or escalate their privileges, posing a critical threat to security and confidentiality.
-
System Compromise: Successful exploitation can lead to full system compromise, enabling attackers to manipulate the virtualized assets managed by vCenter. This could include altering virtual machine settings, disrupting services, and even gaining access to sensitive data hosted on those machines.
-
Operational Disruption: The exploitation of this vulnerability could lead to significant operational disruptions. Organizations rely on vCenter for managing their virtual infrastructure, and a successful attack could result in downtime, data loss, and a degradation of service quality, ultimately affecting business continuity and performance.
CISA has reported CVE-2026-59310
CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2026-59310 as being exploited and is known by the CISA as enabling ransomware campaigns.
The CISA's recommendation is: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Affected Version(s)
Cloud Foundation 9.1.x.x
Cloud Foundation 9.0.x.x
Cloud Foundation 5.x
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
News Articles
CISA: Critical VMware RCE flaw now exploited by ransomware gangs
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned security teams that ransomware gangs have now joined ongoing attacks exploiting a critical VMware vCenter vulnerability patched in July.
1 week ago
That April Windows update you skipped? Hackers are exploiting it now
CISA has confirmed active attacks on Windows, macOS, and VMware vulnerabilities. Here's what home users and IT admins need to patch immediately.
China Hackers Breached 361 Networks in 5 Days; CISA Sets 3-Day Patch Window for Enterprise Flaws
CISA patch deadline vulnerabilities 2026: China-nexus hackers breached 361 organizations in 47 countries within five days of a VMware vCenter patch, while a Chinese threat actor deployed the first
References
EPSS Score
50% chance of being exploited in the next 30 days.
CVSS V3.1
Timeline
- 🦅
CISA Reported
- 🟡
Public PoC available
- 💰
Used in Ransomware
- 📈
Vulnerability started trending
- 👾
Exploit known to exist
- 📰
First article discovered by The Hacker News
Vulnerability published
Vulnerability Reserved