EUVD-2026-51097
GHSA-v2gp-49gj-2c9f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach vCenter Syslog server over network
-
DeliverySend crafted syslog input with traversal sequences
-
ExploitEscape intended log directory via ../
-
ExecutionWrite content to executable path
-
PersistExecute arbitrary code on vCenter
-
ImpactCompromise vSphere management plane
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the vCenter Syslog server component; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are needed against a reachable instance, so the primary limiting factor is network exposure of vCenter and its syslog service rather than any credential or configuration prerequisite. The concrete prerequisite named in the description is reachability to the Syslog server on vCenter; deployments that firewall vCenter management interfaces to an isolated management network substantially reduce exposure, while any vCenter whose syslog/management surface is reachable from broader or untrusted networks is directly at risk. No non-default feature toggle is documented as required in the available data. |
| Impact | All signals point to genuine high priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes remote, low-complexity, unauthenticated exploitation requiring no user interaction, and the impact triad (C:H/I:H/A:H) yields the maximum-tier 9.8 base score consistent with unauthenticated RCE. EPSS is not provided in the input, so exploitation probability cannot be quantified here. KEV status is not indicated (no confirmed active exploitation), and no POC is referenced, so this is currently a pre-exploitation window rather than confirmed in-the-wild abuse. The combination of an unauthenticated network-facing RCE on the vSphere management plane historically attracts rapid exploit development, so the absence of a POC today should not lower urgency. No conflicting signals were found between the CVSS vector and the description - both describe network-accessible, code-execution-capable behavior. |
| Exploit ScenarioDerived | An attacker with network reachability to a vCenter appliance sends crafted input to the Syslog server that includes path traversal sequences, escaping the intended log directory to write or reference a controlled path. By landing content in an executable or interpreted location, the attacker triggers arbitrary code execution on the vCenter host, gaining control of the vSphere management plane. No POC is referenced in the available data, but the unauthenticated, no-interaction vector makes weaponization straightforward once details are public. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Remote code execution in VMware vCenter Server (and bundled distributions including Cloud Foundation, vSphere Foundation, Telco Cloud Infrastructure, and Telco Cloud Platform) arises from a directory traversal flaw in the Syslog server component, enabling any actor with network reach to vCenter to run arbitrary code. The CVSS 9.8 vector indicates unauthenticated, low-complexity network exploitation with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and it is not yet listed in CISA KEV, but the vCenter management plane's central role makes this a top-priority patch.
RemediationAI
Apply the fixed vCenter Server build published in Broadcom Security Advisory 38017 (https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017); the input does not contain an exact fixed version number, so pull the precise patched build from that advisory for your vCenter, Cloud Foundation, vSphere Foundation, and Telco Cloud releases - patch available per vendor advisory. Because the flaw is in the Syslog server, the strongest compensating control until patching is to restrict network access to vCenter management interfaces and the syslog listener to a dedicated, tightly firewalled management network, blocking exposure from general or untrusted networks (trade-off: legitimate remote log forwarding and management from other segments will break and must be re-permitted per-source). Where feasible, disable or restrict inbound syslog reception on vCenter if it is not actively required (trade-off: loss of centralized log ingestion on that node). Do not treat these controls as a substitute for the patch, only as a stopgap.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
vCenter Server is the centralized management plane for VMware vSphere estates, controlling ESXi hosts, VMs, storage, and networking. The affected component is the Syslog server, a logging service that accepts and processes log data over the network. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e., path traversal), where attacker-influenced path input is not properly canonicalized or constrained, allowing references such as '../' sequences to escape the intended directory. When traversal reaches a location where attacker-controlled content is later executed or interpreted, it escalates from file access to arbitrary code execution. The affected CPEs (cpe:2.3:a:vmware:vcenter, cloud_foundation, vsphere_foundation, telco_cloud_infrastructure, telco_cloud_platform) confirm the flaw ships in vCenter itself and every product that bundles it.
Know when Vcenter gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable Syslog component yields AV:N/AC:L/PR:N/UI:N, and traversal-driven RCE gives full C:H/I:H/A:H on an unchanged scope.
Primary rating from Vendor (vmware).
CVSS VectorVendor: vmware
Lifecycle Timeline
3DescriptionCVE.org
VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.
Articles & Coverage 3
Latest POC
2 PoC candidates from github (unverified)
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
VMware vCenter Server-the central control point for most organizations' virtualized infrastructure-contains a critical remote code execution vulnerability that allows any network attacker to compromise the entire environment without authentication. This vulnerability affects vCenter Server and all bundled distributions including Cloud Foundation and vSphere Foundation, with no patch currently available from VMware. Immediate network isolation and monitoring of vCenter systems is essential to prevent attackers from gaining control of your virtualization platform and all dependent systems.
Implement network segmentation to restrict direct network access to vCenter Syslog ports to administrative networks only; deploy intrusion detection and prevention systems configured to detect directory traversal attacks and malformed Syslog requests against vCenter; enable comprehensive logging and monitoring of Syslog server component access, file operations, and process execution; enforce firewall rules limiting vCenter network exposure; monitor all outbound connections from vCenter systems for signs of post-exploitation command-and-control activity.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB