Critical VMware vCenter Vulnerability CVE-2026-59310: What Server Admins Need to Know

Broadcom has patched a critical VMware vCenter vulnerability that can allow an unauthenticated attacker with network access to execute arbitrary code. With a CVSS score of 9.8 and no official workaround available, administrators should prioritize updating affected vCenter installations.

VMware administrators have another critical security issue to deal with.

Broadcom disclosed CVE-2026-59310 as part of security advisory VMSA-2026-0006, initially published on July 29, 2026 and updated on August 3.

The vulnerability affects VMware vCenter’s Syslog Server and has received a CVSS v3.1 score of 9.8 out of 10.

More importantly, exploitation does not require an authenticated VMware account.

According to Broadcom, an attacker with network access to a vulnerable vCenter instance may be able to exploit the vulnerability to execute arbitrary code.

For organizations using vCenter as the management plane for large virtualization environments, that makes CVE-2026-59310 a high-priority patching issue.

Key Takeaways

• CVE-2026-59310 affects VMware vCenter.
• The vulnerability is located in the vCenter Syslog Server.
• It is classified as a directory traversal vulnerability.
• Broadcom rates it Critical with a CVSS score of 9.8.
• An attacker requires network access to vCenter.
• Successful exploitation may allow arbitrary code execution.
• Broadcom lists no workaround.
• Security updates are available.
• vCenter 8.0, 9.0 and 9.1 branches are affected.
• Administrators should also review other vulnerabilities included in VMSA-2026-0006.

What Is CVE-2026-59310?

CVE-2026-59310 is a directory traversal vulnerability in the Syslog Server component of VMware vCenter.

Directory traversal vulnerabilities can allow specially crafted requests to access locations outside the directory an application is normally expected to use.

In this case, the potential impact is particularly serious.

Broadcom says that a malicious actor with network access to vCenter may exploit CVE-2026-59310 to execute arbitrary code.

The vulnerability requires:

• network access;
• no privileges;
• no user interaction;
• low attack complexity.

Those characteristics contribute to its CVSS score of 9.8.

Why a vCenter Vulnerability Matters

vCenter is very different from an ordinary application server.

It serves as the centralized management platform for VMware virtual infrastructure.

Depending on the environment, administrators can use vCenter to manage:

• ESXi hosts;
• virtual machines;
• clusters;
• storage;
• virtual networking;
• permissions;
• resource allocation;
• templates;
• snapshots;
• migrations.

That makes the vCenter management plane an extremely sensitive part of a data center.

A vulnerability capable of providing arbitrary code execution on such a system deserves significantly more attention than its CVSS number alone might suggest.

The security of virtualization management infrastructure can ultimately affect many other workloads running underneath it.

Which VMware Versions Are Affected?

Broadcom’s response matrix lists several affected vCenter branches and their corresponding fixed versions.

Product / branch	Fixed version
VMware vCenter 8.0	8.0 U3k
VMware vCenter 9.0.x	9.0.2.0100
VMware vCenter 9.1.x	9.1.0.0300
VMware Cloud Foundation 5.x	Async patch to 8.0 U3k

VMware Cloud Foundation and VMware vSphere Foundation installations containing affected vCenter versions are also covered by the advisory.

Broadcom notes that patches are cumulative, so newer supported versions containing these fixes also remediate the vulnerabilities.

Administrators should verify the latest Broadcom advisory before updating production infrastructure rather than relying solely on a static version table.

There Is No Official Workaround

One detail makes the vulnerability especially important operationally:

Broadcom lists no workaround for CVE-2026-59310.

That means administrators cannot rely on a vendor-provided configuration change as a substitute for installing the security update.

Network isolation can reduce exposure, but it does not remove the underlying vulnerability.

The actual remediation is to install a fixed version.

CVE-2026-59310 Is Not the Only Critical vCenter Issue

CVE-2026-59310 was disclosed as part of a larger VMware security update.

The same advisory also includes CVE-2026-59309, another critical vCenter vulnerability.

CVE-2026-59309 affects the VMware Directory Service and may allow a malicious actor with network access to vCenter to bypass authentication and gain unauthorized access.

It also carries a CVSS score of 9.8.

That means administrators updating vCenter are not dealing with a single isolated vulnerability.

The July 2026 security release addresses multiple security issues across VMware infrastructure.

VMware ESX Is Also Affected by Other Vulnerabilities

VMSA-2026-0006 covers more than vCenter.

Broadcom also addressed vulnerabilities affecting VMware ESX, Workstation and Fusion.

One of the more serious is CVE-2026-47876, an out-of-bounds write vulnerability involving the VMXNET3 virtual network adapter.

The broader advisory therefore matters to organizations operating complete VMware environments, not only administrators responsible for vCenter.

Updating vCenter should be accompanied by a review of the entire VMSA-2026-0006 advisory to determine whether ESX or other VMware components also require updates.

What Server Administrators Should Do Now

1. Check Your vCenter Version

Start by identifying every vCenter instance in the organization.

Do not check only the primary production cluster.

Infrastructure inventories should also include:

• disaster recovery environments;
• secondary data centers;
• test infrastructure;
• staging environments;
• legacy clusters;
• management environments.

Older management systems can easily remain online long after administrators stop actively using them.

2. Compare Your Build Against Broadcom’s Fixed Versions

Determine the exact version and build currently installed.

For the major affected branches, the fixes are available in:

• vCenter 8.0 U3k
• vCenter 9.0.2.0100
• vCenter 9.1.0.0300

If the environment runs an older affected release, plan the upgrade as a security priority.

3. Review Network Exposure

Administrators should determine who can reach vCenter over the network.

A virtualization management interface generally should not be exposed directly to arbitrary internet traffic.

Access should ideally be restricted through controls such as:

• dedicated management networks;
• administrative VPNs;
• bastion hosts;
• trusted IP ranges;
• firewall rules;
• zero-trust access systems.

This does not replace the security update.

It reduces the number of systems capable of reaching a vulnerable management interface.

4. Install the Security Update

Broadcom explicitly recommends applying the fixed versions listed in its response matrix.

Because no official workaround is available, patching is the primary remediation.

Production virtualization environments may require careful maintenance planning, but administrators should weigh that operational inconvenience against the severity of an unauthenticated network-reachable vulnerability with a 9.8 CVSS score.

5. Review vCenter Logs

Administrators should also review logging around sensitive management systems.

Look for unexpected:

• authentication activity;
• network connections;
• administrative actions;
• processes;
• file modifications;
• account changes;
• configuration changes.

The absence of evidence does not prove that a system is secure, but good monitoring significantly improves an organization’s ability to identify suspicious activity.

6. Review the Entire VMware Advisory

Do not stop after patching CVE-2026-59310.

VMSA-2026-0006 contains five CVEs affecting different parts of the VMware ecosystem.

Organizations running ESXi, Workstation, Fusion, Cloud Foundation or related VMware products should determine which additional updates apply to their infrastructure.

Should vCenter Ever Be Exposed to the Internet?

In most environments, unrestricted public access to vCenter is unnecessary.

Management infrastructure should normally be separated from public application infrastructure.

A better architecture places vCenter behind a protected management layer.

For example:

Administrator → VPN / Bastion → Management Network → vCenter

instead of:

Internet → vCenter

Network segmentation is not a replacement for patch management, but it creates another security boundary attackers must cross.

This principle applies beyond VMware.

Administrative interfaces for hypervisors, backup systems, storage arrays, firewalls and server-management platforms should generally receive much stricter access controls than public application servers.

Infrastructure Management Is Becoming a High-Value Target

The significance of vulnerabilities such as CVE-2026-59310 goes beyond VMware.

Modern data centers increasingly depend on centralized management platforms.

A single management system can control dozens, hundreds or even thousands of workloads.

This creates an attractive concentration of privileges.

Security teams therefore need to treat the management plane itself as critical infrastructure.

That means:

• minimizing network exposure;
• applying security updates quickly;
• using strong administrative authentication;
• separating management networks;
• monitoring administrative activity;
• maintaining accurate infrastructure inventories.

A perfectly patched web server provides little comfort if the platform controlling the underlying virtualization environment is poorly protected.

The Bottom Line

CVE-2026-59310 is a critical VMware vCenter vulnerability that server administrators should prioritize.

It affects the vCenter Syslog Server, carries a CVSS score of 9.8 and may allow an unauthenticated attacker with network access to execute arbitrary code.

Broadcom has released fixes and lists no workaround.

Administrators running affected VMware infrastructure should verify their versions and update to the appropriate fixed release.

At the same time, organizations should use this incident as an opportunity to review a broader question:

Who can actually reach your virtualization management infrastructure?

Patching CVE-2026-59310 solves the immediate software vulnerability.

Reducing unnecessary access to vCenter helps reduce the risk from the next one.