vCenter CVE-2026-59309: Patch CVSS 9.8 Auth Bypass Now

On July 29, 2026, Broadcom published security advisory VMSA-2026-0006, disclosing five vulnerabilities across the VMware ESX, vCenter, Workstation, and Fusion product lines. The advisory’s two most severe entries, CVE-2026-59309 and CVE-2026-59310, both carry a maximum CVSSv3.1 base score of 9.8 and are remotely exploitable by unauthenticated attackers with network access to a vCenter Server instance. Broadcom confirms there are no workarounds for either flaw, so applying the fixed builds is the only effective remediation path. The disclosure matters because a compromised vCenter hands an attacker the centralized control plane for an entire virtualized estate — every host, VM, storage policy, and workload managed from that single console becomes attacker-controllable.

For teams running private or hybrid clouds on vSphere, this advisory turns what looks like a vendor patching task into a control-plane containment operation. The flaws sit in two distinct vCenter services, the management plane is rarely segmented as strictly as it should be, and the absence of workarounds leaves no room for a defer-and-defend posture. This analysis maps each CVE to its attack vector, lists the exact fixed builds from Broadcom’s response matrix, and lays out the compensating controls that reduce blast radius during the patching window.

The Five Flaws in VMSA-2026-0006

The advisory spans a severity range of 2.7 to 9.8 and touches vCenter Server, ESX hypervisors, and the desktop hypervisors Workstation and Fusion. Mapping each flaw to the cloud security layers makes the attack surface explicit: the critical vCenter issues live at the management-plane tier, the VMXNET3 issue is a compute-layer host-escape primitive, and the logging defect weakens auditability at the governance tier.

The two CVSS 9.8 vCenter flaws are the urgent priority because they require no credentials and no foothold inside a guest VM — only network reach to the vCenter services. The VMXNET3 issue is a different threat model entirely: it requires local administrative privileges inside a guest and a VMXNET3 adapter, so it is most dangerous in multi-tenant or managed-hosting scenarios where untrusted tenants run workloads on shared hosts.

How CVE-2026-59309 Compromises vCenter

CVE-2026-59309 is an authentication bypass vulnerability in the VMware Directory Service, the LDAP-based identity store that vCenter Server relies on for single sign-on and role-based access control. Because the Directory Service authenticates administrators and service accounts for the management plane, a successful bypass lets a remote attacker assume a trusted identity without ever presenting valid credentials. Broadcom states that a malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized access to the management plane of the system, including the ability to manage hosts, virtual machines, resource pools, and storage policies.

What raises the severity is the blast radius. vCenter is not just a console — it holds privileged credentials to every ESXi host it manages, can deploy and destroy VMs at will, and centralizes the RBAC model for the whole vSphere domain. An attacker who authenticates through the bypass inherits whatever the compromised identity can do, and in many deployments that includes full administrative rights over the virtualized infrastructure. Rapid7 notes that exploitation does not require prior authentication but the attacker must have network access to the affected vCenter services, and that management interfaces are commonly restricted to internal or dedicated management networks — a control that reduces internet exposure but does nothing against an attacker already inside the corporate network. The vulnerability was reported by Phil Brass and Matt South of Atredis Partners, indicating a coordinated disclosure, and at the time of advisory publication there was no known evidence of exploitation or public proof-of-concept code in the wild.

CVE-2026-59310: Traversal to RCE

The second critical flaw, CVE-2026-59310, is a directory traversal vulnerability in the vCenter Syslog server. Directory traversal lets an attacker manipulate file path inputs to read or write files outside an intended directory; here it is weaponized into arbitrary code execution on the vCenter host. The Syslog server component is exposed for centralized log collection, and a network-adjacent attacker who can reach it can traverse out of its expected file scope and execute code, effectively turning vCenter itself into a foothold for lateral movement across the data center. Like the authentication bypass, this vulnerability carries a CVSSv3.1 base score of 9.8, has no vendor workarounds, and is exploitable without credentials.

The combination of the two flaws is what makes this advisory dangerous in aggregate. An attacker could chain CVE-2026-59309 to reach an authenticated session on the management plane and then use CVE-2026-59310 to achieve code execution on the vCenter appliance, or exploit either independently depending on which service is reachable. Because both vulnerabilities are network-accessible and unauthenticated, network segmentation of the vCenter management plane — restricting access to the Directory Service and Syslog service to dedicated management VLANs and jump hosts — becomes the single most important compensating control during the window before patches are fully deployed.

Fixed Builds and Patch Sequence

Broadcom’s response matrix lists specific fixed versions per product line. Patches are cumulative, so the listed build includes all prior fixes. The absence of workarounds means there is no configuration change that neutralizes either critical vulnerability — only the fixed builds close the path. Security teams should treat vCenter patching as the gating step, followed by ESX host patching for the VMXNET3 and logging issues.

The recommended patch sequence follows blast radius, not CVE number. First, inventory every vCenter instance and its management-network exposure using the response matrix to identify which build each one needs. Second, verify that network segmentation already restricts access to the Directory Service (typically ports 389/636 for vmdir) and the Syslog service to management VLANs only, and tighten any gaps before patching. Third, apply the vCenter fixed build during the next maintenance window and confirm the version reports the patched build string. Fourth, patch ESX hosts for CVE-2026-47876 if any VMs use the VMXNET3 adapter, prioritizing hosts in shared or multi-tenant environments. Finally, update Workstation and Fusion to 26H1 to close the lower-severity out-of-bounds read and review ESX logging policy after patching CVE-2026-41709 to restore reliable administrative audit trails.

Compensating Controls Before Full Remediation

Because the two critical vulnerabilities are unauthenticated and network-reachable, the compensating controls that matter most during the patching window are all about restricting who can reach the vCenter services. Management-plane traffic should traverse a dedicated network with strict ingress rules, and interactive access to vCenter should go through a privileged access workstation or jump host with full session logging. If the vCenter Syslog listener is reachable from broader internal networks, block or rate-limit it at the network layer until the patched build is confirmed. For environments where immediate patching is delayed by change freezes, document the exposure explicitly and route a heightened-monitoring profile toward vCenter authentication logs, looking for anomalous logins, new service-account creation, or unexpected RBAC changes that could indicate the authentication bypass is being exercised. Understanding how each layer of a defense-in-depth stack maps to these controls — as covered in the analysis of cloud security layers and where management-plane segmentation fits — helps ensure no tier is left without an explicit control. Broadcom also published a supplemental FAQ for VMSA-2026-0006 that clarifies patch ordering and version numbering, which is worth reviewing before scheduling the maintenance window.

Fontes

• Broadcom — VMSA-2026-0006: VMware ESX, vCenter, Workstation, and Fusion updates address multiple vulnerabilities — https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017
• Rapid7 — Critical VMware vCenter Vulnerabilities Allow Authentication Bypass and Remote Code Execution (CVE-2026-59309, CVE-2026-59310) — https://www.rapid7.com/blog/post/etr-critical-vmware-vcenter-vulnerabilities-allow-authentication-bypass-and-remote-code-execution-cve-2026-59309-cve-2026-59310/
• Cyber Security News — Critical VMware Flaws Allow Attackers to Bypass Authentication and Gain Access to the System — https://cybersecuritynews.com/vmware-flaws-allow-authentication-bypass/