CVE-2026-59310: Broadcom VMware vCenter Path Traversal Vulnerability
Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code.
Overview
VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.
Vulnerability details
VMware vCenter contains a path traversal vulnerability (CWE-22) in its Syslog server component. Path traversal flaws arise when user-supplied input containing directory separator sequences is processed without adequate sanitization, allowing the application to operate on files outside the intended directory boundary. In vCenter's case, the Syslog server accepts attacker-controlled input that can carry traversal sequences, causing the server to read or write files at arbitrary locations on the underlying host filesystem. Broadcom rates this issue at Critical severity.
An attacker with network access to the vCenter instance can send crafted requests to the Syslog server containing path-traversal sequences, requiring no authentication and no user interaction. Successful exploitation allows the attacker to write attacker-controlled content to arbitrary filesystem locations, which in turn produces arbitrary code execution on the vCenter host. Third-party incident response reporting documents active exploitation in the wild, with attackers deploying reverse SSH tooling post-compromise to maintain persistent access to affected systems.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Monitor for unexpected outbound SSH or reverse-tunnel connections originating from the vCenter host process, particularly to external IP addresses with no corresponding administrative session. Healthy vCenter hosts do not initiate reverse SSH to external infrastructure.
- Audit the vCenter host filesystem for newly created or modified files in directories outside the expected Syslog working path, especially executable files, cron entries, or scripts written during or after periods of Syslog server activity.
- Review network flow logs for inbound connections to the vCenter Syslog server port from sources outside the defined management network. Connections from internet-routable addresses to this service are anomalous and warrant immediate investigation.
Remediation
Additional hardening
- Upgrade VMware vCenter to 9.1.0.0300 (for 9.1.x lines), 9.0.2.0100 (for 9.0.x lines), or 8.0 U3k (for 8.0 lines). Broadcom states no workaround is available; patching is the required remediation. Consult the vendor advisory in References for Cloud Foundation, vSphere Foundation, and Telco product guidance.
- Restrict network access to the vCenter management interface and Syslog server port to explicitly defined management hosts and networks using firewall rules or network segmentation. Internet-routable access to vCenter should be removed entirely.
- Audit vCenter hosts for indicators of post-exploitation activity, including unexpected SSH authorized_keys entries, new cron jobs, unfamiliar processes, and outbound connections to external infrastructure, consistent with the reverse SSH persistence technique observed in active exploitation campaigns.
- Apply the principle of least exposure: vCenter should not be reachable from untrusted networks under any operational configuration. Verify perimeter controls are enforced and review any cloud or hosted deployments for unintended public exposure.
Key dates
References
- https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-59310
- https://medium.com/@quirso_de/active-exploitation-of-cve-2026-59310-361-victim-ips-across-47-countries-9783187cc6ff
- https://medium.com/@quirso_de/global-exploitation-of-cve-2026-59310-by-suspected-chinese-nexus-apt-related-cve-2026-59309-443a79e1466d
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-59310
Frequently asked questions
Does CVE-2026-59310 affect my FedRAMP authorization?
If Broadcom VMware vCenter runs inside your authorization boundary, CVE-2026-59310 is a direct concern for your FedRAMP authorization. The vulnerability appears on CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of August 21, 2026. An unpatched KEV within your boundary is a finding your assessor and sponsoring agency will raise. You must either remediate it or formally document a mitigation before that deadline.
How does Knox help me handle CVE-2026-59310?
Knox does not patch Broadcom VMware vCenter on your behalf. Under the FedRAMP shared-responsibility model, that remediation is yours to execute. What Knox provides is the pre-authorized, single-tenant boundary in which you carry out that work, along with continuous compliance monitoring and audit-artifact coverage to document the fix for your next assessment. The patch is your responsibility; maintaining a compliant posture while you apply it is not something you manage on your own.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment for newly disclosed vulnerabilities and compliance issues on an ongoing basis. When something like CVE-2026-59310 surfaces, exposure is identified through continuous monitoring rather than waiting for an assessor to flag it at a scheduled review. That earlier visibility gives your team more time to act before a finding becomes a formal issue.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
What happens if CVE-2026-59310 isn't remediated by August 21, 2026?
If CVE-2026-59310 is not remediated by August 21, 2026, it becomes a Plan of Action and Milestones (POA&M) item. A growing POA&M list is what turns a routine continuous-monitoring review into a difficult conversation with your sponsoring agency. Meeting the deadline keeps your authorization clean and preserves the agency relationship.
Ready to achieve FedRAMP authorization in 90 days or less?
Schedule a meeting to discuss scope, parse readiness, and map your company’s accelerated path to FedRAMP authorization.
_Horizontal_RGB.png)
