CVE-2026-59310
CRITICAL
CVSS 9.8
vcenter
Verified Advisory
Directory traversal in VMware vCenter Syslog server (CVE-2026-59310)
RCE
Path Traversal
VMware
Cloud Foundation
Telco Cloud Infrastructure
Telco Cloud Platform
Vcenter
Vsphere Foundation
VMware vCenter contains a directory traversal vulnerability in the Syslog server component. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code. Broadcom has rated this vulnerability Critical with a CVSSv3 base score of 9.8.
Public POC available.
Affected versions:
- vCenter 9.1.x.x
- vCenter 9.0.x.x
- vCenter 8.0
- VMware Cloud Foundation vCenter 5.x
- VMware Telco Cloud Platform vCenter 3.0, 4.x, 5.0.x, 5.1.x
- VMware Telco Cloud Infrastructure vCenter 3.0
We recommend updating to: 9.1.0.0300, 9.0.2.0100, 8.0 U3k.
CVSS 9.8 · our assessment: act_now
Reference: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017
Details: https://vuln.today/cve/CVE-2026-59310
Verified by vuln.today against published advisories.
Affected versions
- – vCenter 9.1.x.x
- – vCenter 9.0.x.x
- – vCenter 8.0
- – VMware Cloud Foundation vCenter 5.x
- – VMware Telco Cloud Platform vCenter 3.0, 4.x, 5.0.x, 5.1.x
- – VMware Telco Cloud Infrastructure vCenter 3.0
Fixed in: 9.1.0.0300; 9.0.2.0100; 8.0 U3k