Critical VMware vCenter Vulnerabilities Expose Virtualized Environments to Bypass and RCE
Two critical vulnerabilities, CVE-2026-59309 and CVE-2026-59310, with CVSS scores of 9.8, allow unauthenticated remote attackers to bypass authentication or execute arbitrary code on VMware vCenter Server.
Broadcom has issued a critical security advisory, VMSA-2026-0006, detailing two severe vulnerabilities affecting VMware vCenter Server. Both flaws, identified as CVE-2026-59309 and CVE-2026-59310, carry a maximum CVSSv3.1 base score of 9.8, indicating a critical severity level. These vulnerabilities are particularly concerning as they can be exploited by unauthenticated attackers who possess network access to a vulnerable vCenter Server instance.
CVE-2026-59309 is an authentication bypass vulnerability residing within the VMware Directory Service. Successful exploitation of this flaw could allow a remote attacker to circumvent authentication mechanisms, thereby gaining unauthorized access to the vCenter management plane. This level of access could enable an attacker to manipulate critical aspects of the virtualized infrastructure.
Compounding the risk, CVE-2026-59310 is a directory traversal vulnerability affecting the vCenter Syslog server. This vulnerability could permit an attacker with network access to execute arbitrary code on the affected vCenter Server. Given that vCenter Server is the central management component for VMware vSphere environments, compromising it can grant an attacker substantial control over the entire virtualized infrastructure, including all hosted virtual machines and their associated workloads.
A significant factor amplifying the threat posed by these vulnerabilities is that exploitation does not require any prior authentication. While management interfaces like vCenter are often protected by being segmented within internal or dedicated management networks, reducing direct exposure to internet-based threats, the risk remains substantial for attackers who have already gained a foothold within an organization's internal network.
As of the advisory's publication, there is no known evidence of active exploitation or widespread scanning in the wild targeting these specific vulnerabilities. Furthermore, no public proof-of-concept exploit code has been released. However, VMware's vCenter Server has a history of being targeted, having appeared on CISA's Known Exploited Vulnerabilities (KEV) catalog multiple times for other security flaws. This historical context underscores the urgency for organizations to address these newly disclosed issues before exploitation becomes widespread.
VMware strongly urges customers running affected versions of vCenter Server to apply the necessary patches immediately. The vendor explicitly states that there are no workarounds available for CVE-2026-59309 or CVE-2026-59310, making vendor-provided updates the sole effective remediation. Affected products include various versions of VMware vCenter Server, VMware Cloud Foundation, and VMware vSphere Foundation.
Organizations are advised to consult the official Broadcom advisory VMSA-2026-0006 for detailed information on affected versions and the specific patch releases. Security teams should prioritize the application of these updates to mitigate the risk of authentication bypass and remote code execution, thereby safeguarding their critical virtualized environments from potential compromise.