VMware vCenter Path Traversal (CVE-2026-59310)

Catalog analysis: CISA added this entry on August 18, 2026. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. This site’s publication date is shown separately. Check current vendor guidance before acting.

What the vulnerability is

CVE-2026-59310 is a path traversal vulnerability (CWE-22) affecting Broadcom VMware vCenter. The flaw could enable a threat actor with network access to the vCenter instance to execute arbitrary code on the system.

Exposure and applicability

This vulnerability applies to organizations deploying VMware vCenter. The primary exposure path is network access to the vCenter management interface. Because this vulnerability has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog, it is categorized as a high-priority risk for infrastructure owners regardless of whether specific exploitation attempts have been detected in their own environments.

Remediation priorities

Our analysis suggests the following prioritization for vulnerability management teams:

1. Asset Identification and Exposure Mapping: Immediately identify all vCenter instances across the environment. Prioritize assets with direct or indirect internet exposure, as these represent the highest risk of initial access.
2. Vendor Mitigation Deployment: Apply the mitigations provided in the Broadcom security advisory. This is the primary corrective action to address the underlying path traversal flaw.
3. Forensic Triage: In alignment with CISA’s Forensics Triage Requirements, organizations should evaluate their logs for indicators of unauthorized access or arbitrary code execution prior to and during the patching window.

How to validate remediation

To ensure that exposure has been reduced, defenders should move beyond simple version checks. Validation should include:

• Configuration Audit: Verify that the specific mitigations outlined by Broadcom are active and correctly configured on each instance.
• Network Access Verification: Confirm that network segmentation or access control lists (ACLs) restrict vCenter management access to authorized administrative hosts only, reducing the reachable attack surface.
• Verification of Result: A successful remediation is evidenced by the application of vendor-supported fixes combined with a verified restriction of network paths to the affected service.

Limits and open questions

Applying a patch or mitigation could reduce the likelihood of exploitation but does not eliminate all residual risk. It remains unknown whether this vulnerability has been utilized in specific ransomware campaigns. Furthermore, while CISA has established a deadline for federal agencies (2026-08-21), non-federal organizations must determine their own urgency based on their specific threat profile and asset exposure.

Source and editorial note

CVE-2026-59310: Broadcom VMware vCenter Path Traversal Vulnerability · Source date: August 18, 2026 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Request a Vulnerability Assessment