Critical VMware vCenter Vulnerabilities Expose Virtualized Environments to Bypass and RCE
Two critical vulnerabilities, CVE-2026-59309 and CVE-2026-59310, with CVSS scores of 9.8, allow unauthenticated remote attackers to bypass authentication or execute arbitrary code on VMware vCenter Server.
Broadcom has issued a critical security advisory, VMSA-2026-0006, detailing two severe vulnerabilities affecting VMware vCenter Server. Both flaws, identified as CVE-2026-59309 and CVE-2026-59310, carry a maximum CVSSv3.1 base score of 9.8, indicating a critical severity level. These vulnerabilities are particularly concerning as they can be exploited by unauthenticated attackers who possess network access to a vulnerable vCenter Server instance.
CVE-2026-59309 is an authentication bypass vulnerability residing within the VMware Directory Service. Successful exploitation of this flaw could allow a remote attacker to circumvent authentication mechanisms, thereby gaining unauthorized access to the vCenter management plane. This level of access could enable an attacker to manipulate critical aspects of the virtualized infrastructure.
Compounding the risk, CVE-2026-59310 is a directory traversal vulnerability affecting the vCenter Syslog server. This vulnerability could permit an attacker with network access to execute arbitrary code on the affected vCenter Server. Given that vCenter Server is the central management component for VMware vSphere environments, compromising it can grant an attacker substantial control over the entire virtualized infrastructure, including all hosted virtual machines and their associated workloads.
A significant factor amplifying the threat posed by these vulnerabilities is that exploitation does not require any prior authentication. While management interfaces like vCenter are often protected by being segmented within internal or dedicated management networks, reducing direct exposure to internet-based threats, the risk remains substantial for attackers who have already gained a foothold within an organization's internal network.
As of the advisory's publication, there is no known evidence of active exploitation or widespread scanning in the wild targeting these specific vulnerabilities. Furthermore, no public proof-of-concept exploit code has been released. However, VMware's vCenter Server has a history of being targeted, having appeared on CISA's Known Exploited Vulnerabilities (KEV) catalog multiple times for other security flaws. This historical context underscores the urgency for organizations to address these newly disclosed issues before exploitation becomes widespread.
VMware strongly urges customers running affected versions of vCenter Server to apply the necessary patches immediately. The vendor explicitly states that there are no workarounds available for CVE-2026-59309 or CVE-2026-59310, making vendor-provided updates the sole effective remediation. Affected products include various versions of VMware vCenter Server, VMware Cloud Foundation, and VMware vSphere Foundation.
Organizations are advised to consult the official Broadcom advisory VMSA-2026-0006 for detailed information on affected versions and the specific patch releases. Security teams should prioritize the application of these updates to mitigate the risk of authentication bypass and remote code execution, thereby safeguarding their critical virtualized environments from potential compromise.
New analysis from honeypots indicates that attackers are actively scanning VMware vCenter environments for vulnerabilities following Broadcom's VMSA-2026-0006 advisory. This increased fingerprinting activity targets specific endpoints like /sdk/ and /websso/, suggesting reconnaissance efforts are underway to identify vulnerable systems before potential exploitation.
Threat actors have actively begun exploiting CVE-2026-59310, a critical VMware vCenter vulnerability with a CVSS score of 9.8, shortly after Broadcom released patches. QUIRSO's incident response found evidence of path traversal leading to the deployment of a malicious cron job for persistence via reverse_ssh. The exploitation campaign, which began around August 3rd, has impacted at least 361 IP addresses across 47 countries, with a suspected APT actor likely behind the attacks.
The new article details the rapid exploitation of CVE-2026-59310, a critical VMware vCenter Syslog server vulnerability, by APT actors. It highlights that exploitation began just five days after Broadcom's advisory, with 95% of identified victims compromised within a week, and notes the deployment of the reverse_ssh tool for persistent backdoors.
Exploitation of the critical CVE-2026-59310 vulnerability in VMware vCenter Server has been observed in the wild by the incident response firm Quirso. An advanced persistent threat (APT) actor is reportedly using a reverse shell to maintain persistent access on over 360 victim IP addresses across 47 countries, with exploitation beginning shortly after the vulnerability's disclosure on July 29th. The attackers are leveraging the directory traversal flaw to execute arbitrary code, and have been observed deploying the open-source reverse_ssh framework to bypass security controls.