CVE-2026-59309

Attackers Exploit Critical CVE-2026-59310 in VMware vCenter for Persistent Remote Access

A critical vulnerability identified as CVE-2026-59310 in Broadcom VMware vCenter Server is being actively exploited in the wild against internet-exposed instances. The flaw resides in the Syslog server component and enables remote code execution through a path traversal weakness, carrying a CVSS score of 9.8. Attackers have been observed deploying malicious cron jobs and the reverse_ssh tool to establish persistent outbound command-and-control channels since early August 2026. The campaign has impacted 361 unique IP addresses across 47 countries, with notable concentrations in Germany, the United States, Turkey, Iran, and France. Broadcom has released patches under advisory VMSA-2026-0006.1, which also addresses the related CVE-2026-59309, and strongly recommends immediate updates along with network segmentation and log reviews. No workarounds exist, making prompt patching the only effective mitigation.

Broadcom Patches Five Critical VMware Vulnerabilities Including CVSS 9.8 Authentication Bypass

Broadcom has released fixes for five vulnerabilities across multiple VMware products that could enable authentication bypass, remote code execution, and virtual machine escapes. The most severe issue, CVE-2026-59309 with a CVSS score of 9.8, resides in the VMware Directory Service component of vCenter and allows an attacker with network access to bypass authentication entirely. Successful compromise of vCenter grants control over hosts, virtual machines, networks, and storage, posing severe risks to enterprise environments. A second critical flaw, CVE-2026-47876, affects the VMXNET3 virtual adapter in ESX and permits an attacker with administrative privileges inside a guest VM to perform an out-of-bounds write and execute code on the hypervisor host. Additional patches address an unauthorized memory read in ESX, Workstation, and Fusion, along with insufficient logging that could conceal administrative actions. No workarounds exist, and administrators must apply the specified updates to vCenter, ESX, Cloud Foundation, Workstation, and Fusion.

Broadcom Releases Critical Security Updates for VMware vCenter and ESX Vulnerabilities

Broadcom has issued security updates addressing five vulnerabilities in VMware vCenter and VMware ESX, including two rated as Critical. The flaws affect VMware Directory Service and Syslog server processing, potentially allowing authentication bypass and arbitrary code execution. CVE-2026-59309 enables attackers to bypass authentication over the network in VMware Directory Service, risking unauthorized system access. CVE-2026-59310 involves a path traversal issue in Syslog server handling that could lead to remote code execution. Multiple related products including VMware vSphere Foundation, VMware Cloud Foundation, VMware Telco Cloud Platform, and VMware Telco Cloud Infrastructure are also impacted. The advisory VMSA-2026-0006 was published on July 29, 2026, with patches now available.