What is the CVSS score of CVE-2026-59310?

CVE-2026-59310 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.1%.

Which versions of VMware vCenter are affected by CVE-2026-59310?

VMware vCenter Server-the central control point for most organizations' virtualized infrastructure-contains a critical remote code execution vulnerability that allows any network attacker to…. A patch is available.

Is there a public PoC exploit available for CVE-2026-59310?

Yes, a public proof-of-concept exploit is available for CVE-2026-59310. Prioritise patching immediately. EPSS: 1.1%.

How to fix or mitigate CVE-2026-59310?

Within 24 hours, complete an inventory of all VMware vCenter Server deployments (including Cloud Foundation, vSphere Foundation, Telco Cloud Infrastructure, and Telco Cloud Platform variants), assess their network accessibility, and immediately restrict network access to administrative networks only through firewall rules or network segmentation. Within 7 days, deploy enhanced monitoring and comprehensive logging on the Syslog server component of all affected vCenter instances, review existing access logs for signs of exploitation attempts, restrict inbound network connectivity to only trusted administrative networks, and implement intrusion detection signatures for directory traversal attempts targeting the Syslog component. Within 30 days, maintain continuous monitoring of VMware security advisories for patch availability, prepare and test a comprehensive patch deployment procedure for all vCenter variants in your environment, document the patching timeline with change management, and evaluate whether temporary isolation of non-critical vCenter systems is feasible pending patch release.

VMware vCenter CVE-2026-59310

EUVD-2026-51097 CRITICAL

Path Traversal (CWE-22)

2026-07-30 vmware

GHSA-v2gp-49gj-2c9f

RCE Path Traversal VMware Cloud Foundation Telco Cloud Infrastructure Telco Cloud Platform Vcenter Vsphere Foundation

9.8

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable Syslog component yields AV:N/AC:L/PR:N/UI:N, and traversal-driven RCE gives full C:H/I:H/A:H on an unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vmware).

CVSS VectorVendor: vmware

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Added to CISA KEV

Aug 18, 2026 - 17:48 CISA

Patch available

Jul 30, 2026 - 14:03 EUVD

Analysis Generated

Jul 30, 2026 - 13:20 vuln.today

CVE Published

Jul 30, 2026 - 12:19 cve.org

CRITICAL 9.8

DescriptionCVE.org

VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.

Articles & Coverage 3

POC CVE-2026-59310: Proof-of-Concept Repository with Minimal Technical Detail Aug 17, 2026 News 4 New VMware Vulnerabilities - 3 Critical, 1 High Severity Jul 31, 2026 News Critical RCE in VMware vCenter Server via Directory Traversal - CVE-2026-59310 Jul 30, 2026

AnalysisAI

Remote code execution in VMware vCenter Server (and bundled distributions including Cloud Foundation, vSphere Foundation, Telco Cloud Infrastructure, and Telco Cloud Platform) arises from a directory traversal flaw in the Syslog server component, enabling any actor with network reach to vCenter to run arbitrary code. The CVSS 9.8 vector indicates unauthenticated, low-complexity network exploitation with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and it is not yet listed in CISA KEV, but the vCenter management plane's central role makes this a top-priority patch.

Technical ContextAI

vCenter Server is the centralized management plane for VMware vSphere estates, controlling ESXi hosts, VMs, storage, and networking. The affected component is the Syslog server, a logging service that accepts and processes log data over the network. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e., path traversal), where attacker-influenced path input is not properly canonicalized or constrained, allowing references such as '../' sequences to escape the intended directory. When traversal reaches a location where attacker-controlled content is later executed or interpreted, it escalates from file access to arbitrary code execution. The affected CPEs (cpe:2.3:a:vmware:vcenter, cloud_foundation, vsphere_foundation, telco_cloud_infrastructure, telco_cloud_platform) confirm the flaw ships in vCenter itself and every product that bundles it.

RemediationAI

Apply the fixed vCenter Server build published in Broadcom Security Advisory 38017 (https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017); the input does not contain an exact fixed version number, so pull the precise patched build from that advisory for your vCenter, Cloud Foundation, vSphere Foundation, and Telco Cloud releases - patch available per vendor advisory. Because the flaw is in the Syslog server, the strongest compensating control until patching is to restrict network access to vCenter management interfaces and the syslog listener to a dedicated, tightly firewalled management network, blocking exposure from general or untrusted networks (trade-off: legitimate remote log forwarding and management from other segments will break and must be re-permitted per-source). Where feasible, disable or restrict inbound syslog reception on vCenter if it is not actively required (trade-off: loss of centralized log ingestion on that node). Do not treat these controls as a substitute for the patch, only as a stopgap.