CVE-2026-59310

Name of the Vulnerable Software and Affected Versions VMware vCenter versions prior to 9.1.0.0300 VMware vCenter versions prior to 9.0.2.0100 VMware vCenter versions prior to 8.0 U3k VMware vCenter versions prior to 8.0 U2f

Description VMware vCenter contains a directory traversal issue in the Syslog server caused by improper restriction of directory path names. An unauthenticated attacker with network access can exploit this flaw to execute arbitrary code on the system. This issue has been actively exploited in the wild, with over 361 compromised IP addresses identified across 47 countries, including the US, Germany, Turkey, Iran, and France. Additionally, over 450 servers have been observed exposed to the public internet. Real-world attacks have involved the deployment of a reverse ssh tool to establish persistent remote access and command-and-control (C2) channels, and the flaw has been utilized by ransomware campaigns to gain privileged access to virtualized infrastructure.

Recommendations Update VMware vCenter to version 9.1.0.0300. Update VMware vCenter to version 9.0.2.0100. Update VMware vCenter to version 8.0 U3k. Update VMware vCenter to version 8.0 U2f.