Full research report
Critical VMware vCenter Vulnerabilities Allow Authentication Bypass and Remote Code Execution (CVE-2026-59309, CVE-2026-59310)
Executive assessment
Broadcom's VMSA-2026-0006, published 29 July 2026, is a broad patch release anchored by two CVSS 9.8 unauthenticated vulnerabilities in VMware vCenter Server. CVE-2026-59309 (CWE-303) exploits a flaw in the VMware Directory Service authentication algorithm, allowing a network-adjacent unauthenticated attacker to bypass authentication and reach the vCenter management plane — the administrative nerve centre of any VMware vSphere environment. CVE-2026-59310 (CWE-22) adds a path-traversal weakness in the vCenter Syslog server, independently reachable without credentials, that can result in arbitrary code execution on the appliance itself; CISA SSVC independently characterises this as automatable with total impact potential. The advisory is broader than the headline pair: CVE-2026-47876 (CVSS 9.3) introduces a VMXNET3 out-of-bounds write enabling a local VM administrator to execute code on the ESXi host — a VM escape with significant data-centre implications. As of 30 July 2026, no exploitation or public proof-of-concept code has been confirmed by any primary source and neither vCenter CVE has been added to the CISA KEV catalogue; however, vCenter's historical targeting trajectory — ten prior KEV listings for other flaws — and Broadcom's emergency-change classification make early patching operationally essential before the exploitation window opens.
What happened
On 29 July 2026, Broadcom published VMSA-2026-0006, disclosing five vulnerabilities across VMware vCenter, ESXi, Workstation, Fusion, and Telco Cloud products. Two of those — CVE-2026-59309 and CVE-2026-59310 — are unauthenticated, network-exploitable critical flaws in vCenter Server, each carrying a CVSS 9.8 score. A third critical entry, CVE-2026-47876 (CVSS 9.3), enables a virtual machine escape via the VMXNET3 adapter in ESXi but requires local VM administrative access. As of 30 July 2026, Broadcom, Rapid7, BleepingComputer, and The Hacker News all confirm no evidence of in-the-wild exploitation or public proof-of-concept code for any disclosed vulnerability.
Affected scope
VMware vCenter Server 8.0, 9.0.x, and 9.1.x; VMware Cloud Foundation 5.x, 9.0.x, 9.1.x; VMware vSphere Foundation 9.0.x, 9.1.x; VMware Telco Cloud Platform 3.0, 4.x, 5.0.x, 5.1.x; VMware Telco Cloud Infrastructure 3.0; VMware ESXi, Workstation, and Fusion (relevant to CVE-2026-47876 and the lower-severity CVEs). Applies broadly to enterprise on-premises and hosted virtualisation environments.
Technical assessment
CVE-2026-59309 (CWE-303: Incorrect Implementation of Authentication Algorithm) resides in the VMware Directory Service — the LDAP-based identity backbone of vCenter — and allows an unauthenticated network-adjacent attacker to bypass the authentication mechanism and obtain access to the vCenter management plane. CVE-2026-59310 (CWE-22: Path Traversal) is a directory traversal weakness in the vCenter Syslog server that is reachable without authentication and can result in arbitrary code execution on the vCenter appliance. Neither vulnerability requires any prior credential or user interaction. Because vCenter provides centralised control over ESXi hosts, virtual machines, and storage, successful exploitation grants extensive lateral movement capability across the managed virtualisation estate. No workarounds exist; patching is the sole mitigation. CISA SSVC analysis independently characterises CVE-2026-59310 as automatable with total potential impact.
Recommended defensive actions
- Apply VMSA-2026-0006 patches on an emergency basis: vCenter 9.1.x → 9.1.0.0300; vCenter 9.0.x → 9.0.2.0100; vCenter 8.0 → 8.0 U3k; Cloud Foundation 5.x → async patch to 8.0 U3k; Telco Cloud Platform and Infrastructure → consult Broadcom KB449886.
- Restrict network access to all vCenter management interfaces (TCP 443, 636, 389 and related ports) to dedicated management VLANs and explicitly named administrator hosts, blocking all internet-facing exposure immediately.
- Monitor vCenter authentication logs and Directory Service event records for anomalous or unexpected authentication successes from non-administrative or unrecognised source addresses.
- Audit firewall rules and network segmentation policies to verify no vCenter management interfaces are reachable from untrusted networks, guest VM segments, or the public internet.
- Subscribe to Broadcom VMSA security advisories to ensure prompt notification for future VMware vCenter and ESXi patches.
Uncertainties and evidence gaps
- The precise technical mechanism by which CVE-2026-59309 bypasses the VMware Directory Service authentication algorithm has not been publicly disclosed; the exact attack surface may differ from current descriptions once research or PoC code becomes available.
- Historical precedent — vCenter has appeared on the CISA KEV catalogue ten times for prior vulnerabilities — makes rapid weaponisation likely; it is unknown whether threat actors are privately developing exploit code against these flaws.
- NIST NVD enrichment was pending as of 30 July 2026 for both primary CVEs; independent CVSS scoring could revise the severity or attack-vector assessment.
- The Telco Cloud Platform and Infrastructure remediation path (KB449886) was not independently fetched and verified; operators of those products should consult Broadcom directly to confirm applicability and patch availability.
- The supplied reporting identifies CVE-2026-593099, but the reviewed sources did not establish its distinct role in this event.
Vulnerability flow
Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.
No confirmed active exploitation or in-the-wild scanning detected; no public proof-of-concept code available as of 30 July 2026. CISA SSVC analysis notes automatable attack characteristics and total potential impact, indicating elevated urgency despite the absence of observed exploitation.
The investigation began with a single supplied source — the Rapid7 ETR article — documenting two CVSS 9.8 unauthenticated vCenter flaws from Broadcom advisory VMSA-2026-0006 published 29 July 2026. The Broadcom advisory was fetched directly, confirming both headline CVEs and revealing three additional vulnerabilities, including a VMXNET3-based VM escape. BleepingComputer and The Hacker News provided independent corroboration and confirmed the emergency-change classification. NVD records for both primary CVEs were fetched to obtain CWE classifications and CISA SSVC data. A targeted CISA KEV search found neither CVE listed, consistent with the absence of confirmed in-the-wild exploitation.
- Does the supplied Rapid7 ETR article exist and what key facts does it establish?Fetched the Rapid7 ETR blog post.rapid7.com ↗
Confirmed: CVE-2026-59309 (auth bypass, CVSS 9.8) and CVE-2026-59310 (directory traversal RCE, CVSS 9.8), no known exploitation or PoC, no workarounds, per-product patch table, Broadcom advisory reference VMSA-2026-0006.
why Verified the primary supplied source and extracted a structured fact baseline to guide subsequent searches.
- What other security sources cover VMSA-2026-0006, and does broader searching reveal exploitation evidence or PoC code?Searched for VMSA-2026-0006 alongside both CVE IDs across news and security outlets.
Multiple independent outlets confirmed the advisory. BleepingComputer and The Hacker News headlines indicated the full advisory includes a VM escape (CVE-2026-47876, CVSS 9.3 via VMXNET3), not mentioned in the Rapid7 article. No PoC or active exploitation reported anywhere.
why Identified two credible independent sources for corroboration and expanded the advisory scope beyond the two headline CVEs.
- What does the Broadcom vendor advisory state directly, and does it disclose anything secondary reporting omitted?Fetched the Broadcom VMSA-2026-0006 advisory page.support.broadcom.com ↗
Advisory confirmed five CVEs total, no workarounds for any, no known exploitation. Broadcom classifies the patches as 'emergency change'. Affected platforms extend to Workstation and Fusion in addition to vCenter and ESXi.
why Primary vendor source anchors the report; 'no workarounds' finding directly determines the defensive recommendation to patch without alternative mitigation.
- Does BleepingComputer independently corroborate the exploitation status and add technical detail?Fetched the BleepingComputer article.bleepingcomputer.com ↗
Independently confirmed no exploitation, emergency-change classification, and that CVE-2026-47876 constitutes a VM-to-host escape. Article noted ransomware groups maintain dedicated ESXi tooling, contextualising the risk environment.
why First independent domain corroboration; VM escape detail and ransomware context are material for defenders assessing broader risk.
- Does The Hacker News provide a second independent confirmation and any additional technical clarification?Fetched The Hacker News article.thehackernews.com ↗
Second independent source confirmed Broadcom found no evidence of exploitation, clarified CVE-2026-47876 requires local VM administrative access (limiting its immediate exposure), and confirmed emergency-change status for all five CVEs.
why Second independent domain raises confidence in the exploitation assessment; the access-requirement clarification for the VM escape is material for risk prioritisation.
- What CWE classifications and CISA SSVC data do the NVD records hold for the two headline CVEs?Fetched NVD records for CVE-2026-59309 and CVE-2026-59310.nvd.nist.gov ↗
CVE-2026-59309: CWE-303, CVSS 9.8 from VMware CNA, NIST scoring pending. CVE-2026-59310: CWE-22, CVSS 9.8, CISA SSVC characterises it as automatable with total impact and no current exploitation feasibility. Both records marked for enrichment.
why CWE classifications sharpen the technical description; CISA SSVC data is an independent government-sourced severity signal that supports the emergency-patch recommendation.
- Have either CVE been added to the CISA Known Exploited Vulnerabilities catalogue, indicating confirmed in-the-wild exploitation?Searched for CISA KEV catalogue entries for CVE-2026-59309 and CVE-2026-59310.
Neither CVE appears in the CISA KEV catalogue as of 30 July 2026. The most recent CISA KEV addition alert predates this advisory (16 July 2026 and earlier). CISA SSVC data was added to NVD on 30 July 2026, indicating active government assessment.
why Absence from KEV is consistent with all vendor and media claims of no confirmed exploitation; SSVC addition confirms CISA is actively monitoring these vulnerabilities.
Research coverage
All 68 registered source leaves were evaluated for this run: 61 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 3 registered sources supplied useful evidence (2 primary, 1 corroborating, 0 contextual and 0 PoC/exploit references). 58 completed sources contained no matched information for this story.
Complete source-by-source audit 68 sources
| Source | Run result | Value | Why it was useful — or not |
|---|---|---|---|
| NVDcve | ok900 records | Primary evidence2 matched items | Supplied a vendor or government advisory opened and verified during focused research. |
| Rapid7news | ok4 records | Primary evidence2 matched items | Published the source report used to frame and date the event. Supplied independent analysis opened and verified during focused research. |
| BleepingComputernews | ok10 records | Corroborating1 matched items | Supplied independent analysis opened and verified during focused research. |
| AlienVault OTXdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CIRCL CVEcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CISA Alertsnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| CISA KEVkev | ok1656 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco PSIRTvendor_advisory | ok5309 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco Talosnews | ok2 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI CVE most exploiteddeepdarkcti | ok94 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Discorddeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI exploitsdeepdarkcti | ok24 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI forumsdeepdarkcti | ok260 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware as a servicedeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware samplesdeepdarkcti | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI marketsdeepdarkcti | ok127 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI phishingdeepdarkcti | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI ransomware gangsdeepdarkcti | ok667 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI RATsdeepdarkcti | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram infostealerdeepdarkcti | ok130 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram threat actorsdeepdarkcti | ok1006 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Twitter threat actorsdeepdarkcti | ok39 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| DNSDumpster domain IOC enrichmentresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Exploit-DBexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| FIRST EPSSepss | ok7136 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Fortinet PSIRTvendor_advisory | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| GitHub topic: cveresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: exploitresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: penetration-testingresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: pocresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: vulnerabilityresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GreyNoiseexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| KrebsOnSecuritynews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| LinkedIn RSS proxy feeds (disabled)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| MalwareBazaardark_web | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cveresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cybersecurityresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #exploitresearch | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #infosecresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #malwareresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #ransomwareresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #threatintelresearch | ok13 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #vulnerabilityresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Metasploit module metadataexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Microsoft MSRCvendor_advisory | ok1588 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Microsoft Securitynews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| MISP Galaxyresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP threat actor galaxyactor | ok0 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Palo Alto Networks PSIRTvendor_advisory | ok25 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ProjectDiscovery nuclei templatesexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Reddit r/AskNetsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/cybersecurity (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/malware (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/netsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/ReverseEngineering (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| SANS ISCnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Shadowserver public aggregate honeypot observationsexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shodanresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sigma Rulesresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sophos IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| The Hacker Newsnews | ok11 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ThreatFoxthreat_intelligence | ok100 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| UK NCSCnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Unit42 IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| URLhausdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VirusTotal Community IOC enrichmentresearch | ok4 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VulnCheck KEVkev | ok500 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Vulnerability Lookupcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
Additional verified pages 2 opened outside the registered collection
Vendor & gov advisories3
Primary Broadcom vendor advisory; explicitly states no workarounds exist for any of the five CVEs
Confirms CVSS 9.8, CWE-303; CISA SSVC data appended 30 July 2026, NIST enrichment pending
Confirms CVSS 9.8, CWE-22; CISA SSVC characterises attack as automatable with total impact, exploitation feasibility currently none
Analysis & research3
Detailed ETR with per-product patch table; unauthenticated vulnerability checks released 30 July 2026 for InsightVM and Nexpose
First independent corroboration; extends scope to VMXNET3 VM-escape (CVE-2026-47876) and emergency-change classification
Second independent corroboration; confirms Broadcom found no evidence of exploitation, clarifies VM-escape requires local VM admin access