Two pre-auth vulnerabilities in VMware vCenter: authentication bypass and RCE

Raphaël Dray of Mobeta analyzed CVE-2026-59309 and CVE-2026-59310 — two critical VMware vCenter vulnerabilities that can be exploited without prior authentication.

CVE-2026-59309 — an authentication bypass in VMware Directory Service (vmdird). The flaw was in the Cyrus SASL libsrp.so library, which implements SRP (Secure Remote Password) for LDAP authentication. The server checked that the public value A was greater than zero but omitted the required A mod N != 0 check. By sending A = N, an attacker can obtain a predictable shared secret and generate a valid authentication proof without knowing the password.

The researcher confirmed the attack by performing an SRP bind as administrator@vsphere.local without a password and gaining access to the vSphere SSO directory. Patch diffing showed that the fix added the missing modulo check in srp_server_mech_step2.

CVE-2026-59310 affects vCenter's Syslog infrastructure. Sender-controlled HOSTNAME and APP-NAME values were inserted into rsyslog output paths without protection against path traversal. A specially crafted Syslog message allows an attacker to escape /var/log/vmware/ and write a file to an arbitrary location where rsyslog has write permission. The researcher demonstrated writing to the VAMI web root and confirmed RCE, but intentionally did not disclose the full code-execution chain.

Exploitation requires network access to the Syslog listener — UDP/TCP 514 or TLS Syslog. rsyslog itself is not vulnerable: the issue was in VMware's configuration template, and the fix uses secpath-replace to sanitize attacker-controlled path components.

Mobeta's analysis compares the vulnerable vCenter 8.0.3.00900 with the fixed 8.0.3.01000, in which both issues are patched.

Article: https://mobeta.fr/blog/vcenter-cve-2026-59309-cve-2026-59310/