Broadcom VMware vCenter Path Traversal Vulnerability
TL;DR 📌
- Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code.
- Highest CVSS: 9.8 (Critical).
- Listed in CISA KEV (2026-08-18) — this is being exploited in the wild.
- Check the advisory for fixed releases — remediation detail is in the vendor link below.
- CVEs: CVE-2026-59310.
What it is
CVE-2026-59310 is a path traversal vulnerability in Broadcom VMware vCenter. It has a CVSS score of 9.8 (Critical), with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — meaning it is reachable over the network, requires low attack complexity, needs no privileges and no user interaction, and results in full compromise of confidentiality, integrity and availability.
The flaw sits in vCenter itself. Broadcom describes it as allowing a threat actor with network access to vCenter to execute arbitrary code. Given the CVSS vector, no authentication is required to trigger it — network reachability to vCenter is sufficient.
The vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalogue, added on 18 August 2026, so it is known to be exploited.
The advisory does not currently list fixed releases, and no further advisory detail has been published beyond the summary above.
What to do
- Treat vCenter as a priority patching target. Consult Broadcom’s advisory directly for fixed releases as they become available, since none are listed at present.
- Restrict network access to vCenter to the minimum required set of management hosts and jump boxes; it should not be reachable from general user networks or the internet.
- Given the KEV listing, follow your organisation’s expedited remediation process for known-exploited vulnerabilities rather than standard patch cycles.
- Review vCenter access logs for anomalous requests, particularly those consistent with path traversal patterns, while awaiting a fix.
- Once Broadcom publishes fixed releases, apply them promptly and confirm the version against the advisory rather than relying on this summary.
For leadership 🧭
Executive summary. vCenter, the console that controls your entire virtual infrastructure, can be fully compromised by anyone who can reach it over the network, with no login required, and attackers are already using this flaw. This needs emergency network isolation and access-log review today, not scheduling into a normal patch cycle.
Why it matters:
- vCenter is the management plane for the whole virtual estate; arbitrary code execution there gives an attacker control over every host and VM it manages.
- No authentication or user interaction is needed — simple network reachability to vCenter is enough to trigger the path traversal and run code.
- The vulnerability is in CISA’s Known Exploited Vulnerabilities catalogue, confirming active exploitation rather than theoretical risk.
- No fixed release is currently listed, so network-level containment is the only mitigation available right now.
Now / Next / Later:
- Now: Restrict network access to vCenter immediately to only the specific management hosts and jump boxes that need it, removing any exposure to general user networks or the internet.
- Next: Review vCenter access and request logs for path-traversal-style patterns and anomalous requests, and apply Broadcom’s fixed release as soon as it is published, verifying the version against the advisory.
- Later: Establish an expedited remediation track for KEV-listed vulnerabilities affecting core infrastructure like vCenter, so isolation and patching can bypass standard change windows.