CVE-2026-59310

Name of the Vulnerable Software and Affected Versions VMware vCenter versions prior to 9.1.0.0300 VMware vCenter versions prior to 9.0.2.0100 VMware vCenter versions prior to 8.0 U3k VMware vCenter versions prior to 8.0 U2f

Description VMware vCenter contains a directory traversal flaw in the Syslog server caused by improper restriction of directory path names. An unauthenticated attacker with network access can exploit this issue to execute arbitrary code. This flaw has been actively exploited by advanced persistent threat actors and ransomware gangs, with over 361 compromised IP addresses identified across 47 countries. Attackers have used the vulnerability to establish persistence via reverse ssh tools, create privileged vSphere identities, and deploy ransomware. Shadowserver has tracked more than 450 VMware vCenter servers exposed to the public internet.

Recommendations Update VMware vCenter to version 9.1.0.0300. Update VMware vCenter to version 9.0.2.0100. Update VMware vCenter to version 8.0 U3k. Update VMware vCenter to version 8.0 U2f.