EUVD-2026-51097
GHSA-v2gp-49gj-2c9f
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable Syslog component yields AV:N/AC:L/PR:N/UI:N, and traversal-driven RCE gives full C:H/I:H/A:H on an unchanged scope.
Primary rating from Vendor (vmware).
CVSS VectorVendor: vmware
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.
Articles & Coverage 2
AnalysisAI
Remote code execution in VMware vCenter Server (and bundled distributions including Cloud Foundation, vSphere Foundation, Telco Cloud Infrastructure, and Telco Cloud Platform) arises from a directory traversal flaw in the Syslog server component, enabling any actor with network reach to vCenter to run arbitrary code. The CVSS 9.8 vector indicates unauthenticated, low-complexity network exploitation with full confidentiality, integrity, and availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network access to the vCenter Syslog server component; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are needed against a reachable instance, so the primary limiting factor is network exposure of vCenter and its syslog service rather than any credential or configuration prerequisite. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All signals point to genuine high priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with network reachability to a vCenter appliance sends crafted input to the Syslog server that includes path traversal sequences, escaping the intended log directory to write or reference a controlled path. By landing content in an executable or interpreted location, the attacker triggers arbitrary code execution on the vCenter host, gaining control of the vSphere management plane. … |
| Remediation | Apply the fixed vCenter Server build published in Broadcom Security Advisory 38017 (https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017); the input does not contain an exact fixed version number, so pull the precise patched build from that advisory for your vCenter, Cloud Foundation, vSphere Foundation, and Telco Cloud releases - patch available per vendor advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, complete an inventory of all VMware vCenter Server deployments (including Cloud Foundation, vSphere Foundation, Telco Cloud Infrastructure, and Telco Cloud Platform variants), assess their network accessibility, and immediately restrict network access to administrative networks only through firewall rules or network segmentation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Cloud Foundation
View allVMware ESXi and Workstation contain a TOCTOU race condition leading to out-of-bounds write, allowing local administrator
VMware ESXi contains an arbitrary write vulnerability that allows privileged VMX process users to trigger kernel writes,
VMware Aria Operations contains a command injection vulnerability (CVE-2026-22719, CVSS 8.1) that allows unauthenticated
VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability via HGFS out-of-bounds read, allowi
VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side templa
The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. Rated critical severity (CV
The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual
The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. Rated critical sev
The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo. Rated h
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due t
The vCenter Server contains multiple local privilege escalation vulnerabilities due to improper permissions of files and
Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today