CVE-2026-59310KEV · OVERDUECWE-22path-traversal

Broadcom VMware vCenter Path Traversal Vulnerability

Critical · published July 30, 2026

Patch now

Confirmed exploited, and the score agrees

CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 85.0th percentile for exploit probability.

64
days past CISA
deadline
CVSS v3.1
9.8
EPSS
3%
Percentile
85.0
In the wild
Confirmed
What it is

VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02565 · 85.0th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-07-30T17:16Z
KEV added
2026-08-18 · due 2026-08-21
Affected products (29)
ProductVersionsFixed in
vmware/vcenter_server< 8.08.0
vmware/vcenter_serverall versions—
vmware/vcenter_serverall versions—
vmware/vcenter_serverall versions—
vmware/vcenter_serverall versions—
vmware/vcenter_serverall versions—
vmware/vcenter_serverall versions—
vmware/vcenter_serverall versions—
vmware/vcenter_serverall versions—
vmware/vcenter_serverall versions—
vmware/vcenter_serverall versions—
vmware/vcenter_serverall versions—
vmware/vcenter_serverall versions—
vmware/vcenter_serverall versions—
vmware/vcenter_serverall versions—
vmware/vcenter_serverall versions—
vmware/vcenter_serverall versions—
vmware/vcenter_serverall versions—
vmware/vcenter_serverall versions—
vmware/vcenter_serverall versions—
vmware/vcenter_serverall versions—
vmware/vcenter_serverall versions—
vmware/vcenter_serverall versions—
vmware/vcenter_serverall versions—
vmware/vcenter_serverall versions—
vmware/vcenter_serverall versions—
vmware/vcenter_serverall versions—
vmware/vcenter_server≥ 9.0, < 9.0.2.01009.0.2.0100
vmware/vcenter_server≥ 9.1, < 9.1.0.03009.1.0.0300
References (4)
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017 · [email protected]https://medium.com/@quirso_de/active-exploitation-of-cve-2026-59310-361-victim-ips-across-47-countries-9783187cc6ff · 134c704f-9b21-4f2e-91b3-4a467353bcc0https://medium.com/@quirso_de/global-exploitation-of-cve-2026-59310-by-suspected-chinese-nexus-apt-related-cve-2026-59309-443a79e1466d · 134c704f-9b21-4f2e-91b3-4a467353bcc0https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-59310 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 25 SEP 03:26Z
    EPSS moved 50% → 3%
    epss
  • 30 JUL 12:19Z
    vCenter directory-traversal vulnerability
    cvelistv5