Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-59310 |
| Alert Source | CISA KEV - Active Exploitation |
| CVE Publication Year | 2026 |
| Date Published | 2026-08-18 |
| Vendor | Broadcom |
| Product | VMware vCenter Server |
| CVSS Score | 9.8 (critical) |
| EPSS Score | 1.1% (percentile: 64%) |
| CISA KEV | Yes - confirmed active exploitation |
| Ransomware | Not confirmed |
| Remediation Deadline | 2026-08-21 |
Vulnerability Description
Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code.
Required Actions
This is the highest-priority alert in this batch. The CISA remediation deadline is August 21, 2026.
- Apply the Broadcom fix from the VMware security advisory (Security Advisory 38017). Affected products include not only standalone vCenter Server but also VMware Cloud Foundation, vSphere Foundation, Telco Cloud Infrastructure and Telco Cloud Platform — check all licensing variants.
- Before patching, restrict network access to vCenter to a dedicated management network only. vCenter should never be reachable from user networks or the internet — and those are exactly the installations being attacked today.
- Run a compromise assessment, not just an update. Since the flaw has been exploited for some time, patching alone will not undo an earlier breach. Review vCenter logs, local accounts, scheduled tasks and role assignments.
- Treat vCenter as a system of critical importance: its compromise means control over the entire virtual environment, including access to virtual machine disks bypassing guest OS protections.
Who Is Affected?
Any organization running VMware vCenter Server — which covers the vast majority of mid-sized and large companies operating their own virtualization. Also check VMware Cloud Foundation and vSphere Foundation environments. Given the CISA KEV listing, entities in scope of NIS2 should document the timing and method of remediation.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
