CVE-2026-59310
CRITICAL · 9.8 EPSS 1.1%Vendor advisory + urgent patching + credible analyst coverage; no KEV or PoC confirms mixed signal.
What: VMware vCenter Syslog server directory traversal vulnerability allowing unauthenticated remote code execution (CVSS 9.8 CRITICAL).
Why it matters: Broadcom released security advisory VMSA-2026-0006 on 2026-07-29 addressing this flaw alongside CVE-2026-59309 (auth bypass). Multiple credible sources (Rapid7, Bleeping Computer) confirm vendor patch availability and severity. No public PoC or KEV listing yet, but urgent patching signals active vendor remediation and likely high defender priority.
Where it's seen: Social media aggregating Broadcom advisory; security research blogs flagging as critical in multi-CVE bundles; no PoC chatter or scanning reports observed.
RISK: CRITICAL — CVSS 9.8, unauthenticated RCE, vendor patched immediately, likely targets.
Description
VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.
CVSS 3.1 breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Attack vector
- Network
- Complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High