What is the CVSS score of CVE-2026-59309?

CVE-2026-59309 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of VMware vCenter are affected by CVE-2026-59309?

VMware vCenter's Directory Service contains a critical authentication bypass vulnerability (CVSS 9.8) that enables unauthenticated remote attackers to gain unauthorized administrative access without…. A patch is available.

How to fix or mitigate CVE-2026-59309?

Within 24 hours: identify and document all vCenter instances across your environment and assess their network reachability; implement emergency network access controls restricting vCenter connectivity to designated administrative networks or jump hosts only; brief executive leadership on the critical severity and unavailability of a vendor patch. Within 7 days: deploy enhanced authentication logging and intrusion detection signatures to monitor vmdir access patterns; conduct vulnerability assessments to confirm no unauthorized access has occurred; ensure offline, encrypted backups of vCenter configurations and VM inventory are current and isolated from production systems. Within 30 days: monitor VMware/Broadcom security advisories daily for patch release; develop and test a rapid deployment plan for patch installation once available; evaluate alternative vCenter architectures or third-party solutions if patch timeline exceeds acceptable risk thresholds.

VMware vCenter CVE-2026-59309

EUVD-2026-51098 CRITICAL

Incorrect Implementation of Authentication Algorithm (CWE-303)

2026-07-30 vmware

GHSA-fcv2-9hgc-5mgq

Authentication Bypass VMware Cloud Foundation Telco Cloud Infrastructure Telco Cloud Platform Vcenter Vsphere Foundation

9.8

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

vuln.today AI

9.8 CRITICAL

Pre-auth, network-reachable authentication bypass with low complexity and no interaction yields full admin-equivalent access, so PR:N and C/I/A all High.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vmware).

CVSS VectorVendor: vmware

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 30, 2026 - 14:03 EUVD

Analysis Generated

Jul 30, 2026 - 13:21 vuln.today

CVE Published

Jul 30, 2026 - 12:19 cve.org

CRITICAL 9.8

DescriptionCVE.org

VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized access to the system.

Articles & Coverage 2

News 4 New VMware Vulnerabilities - 3 Critical, 1 High Severity Jul 31, 2026 News Critical Authentication Bypass in VMware vCenter vmdir - CVE-2026-59309 Jul 30, 2026

AnalysisAI

Authentication bypass in VMware vCenter's Directory Service (vmdir) lets an attacker with network reachability to vCenter defeat the authentication algorithm and obtain unauthorized access without valid credentials. Because vCenter is the central management plane for vSphere environments, this exposes control over the entire virtual estate; the flaw is remotely exploitable with no privileges or user interaction (CVSS 9.8). At time of analysis there is no public exploit identified and it is not listed in CISA KEV, but the reporting vendor (VMware/Broadcom) rates it critical.

Technical ContextAI

The affected component is the VMware Directory Service (vmdir), the LDAP-based identity store underpinning vCenter Single Sign-On and the vSphere authentication domain. The root cause is classified as CWE-303 (Incorrect Implementation of Authentication Algorithm), meaning the service validates authentication material in a way that can be subverted rather than a simple missing check. CPE data shows the vulnerability ships through multiple VMware packaging bundles that embed vCenter: VMware vCenter itself, VMware Cloud Foundation, VMware vSphere Foundation, VMware Telco Cloud Infrastructure, and VMware Telco Cloud Platform. Compromising vmdir undermines the trust anchor for the whole SSO domain, so a successful bypass can cascade into administrative access across managed hosts and services.

RemediationAI

Apply the fixed vCenter builds published by Broadcom/VMware in the security advisory referenced at https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017; because the exact patched version is not enumerated in the provided data, obtain the precise fixed build for your specific deployment (standalone vCenter, Cloud Foundation, vSphere Foundation, or Telco Cloud) from that advisory - patch available per vendor advisory. As compensating controls until patching, restrict network access to the vCenter management interfaces (notably TCP 443 and the vmdir LDAP endpoints 389/636) to a dedicated management network or jump-host allowlist so the service is not reachable from general or internet-facing segments, accepting the trade-off that automation and integrations reaching vCenter over the network must be explicitly allowlisted. Additionally review and rotate SSO and administrator credentials and monitor vmdir/SSO authentication logs for anomalies after patching, and never expose vCenter directly to the internet.