CVE-2026-59309CWE-303

CVE-2026-59309

Critical · published July 30, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
48.6
In the wild
Unconfirmed
What it is

VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized access to the system.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00611 · 48.6th percentile
Weakness
CWE-303 · Incorrect Implementation of Authentication Algorithm
Published
2026-07-30T17:16Z
Affected products (29)
ProductVersionsFixed in
vmware/vcenter_server< 8.08.0
vmware/vcenter_serverall versions—
vmware/vcenter_serverall versions—
vmware/vcenter_serverall versions—
vmware/vcenter_serverall versions—
vmware/vcenter_serverall versions—
vmware/vcenter_serverall versions—
vmware/vcenter_serverall versions—
vmware/vcenter_serverall versions—
vmware/vcenter_serverall versions—
vmware/vcenter_serverall versions—
vmware/vcenter_serverall versions—
vmware/vcenter_serverall versions—
vmware/vcenter_serverall versions—
vmware/vcenter_serverall versions—
vmware/vcenter_serverall versions—
vmware/vcenter_serverall versions—
vmware/vcenter_serverall versions—
vmware/vcenter_serverall versions—
vmware/vcenter_serverall versions—
vmware/vcenter_serverall versions—
vmware/vcenter_serverall versions—
vmware/vcenter_serverall versions—
vmware/vcenter_serverall versions—
vmware/vcenter_serverall versions—
vmware/vcenter_serverall versions—
vmware/vcenter_serverall versions—
vmware/vcenter_server≥ 9.0, < 9.0.2.01009.0.2.0100
vmware/vcenter_server≥ 9.1, < 9.1.0.03009.1.0.0300
References (1)
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017 · [email protected]
EPSS history
Timeline
  • 30 JUL 12:19Z
    vCenter authentication-bypass vulnerability
    cvelistv5