Broadcom VMware vCenter Path Traversal Vulnerability

🚨SEVERITY: CRITICAL — CVSS 9.8Security Advisory

TL;DR 📌

  • Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code.
  • Highest CVSS: 9.8 (Critical).
  • Listed in CISA KEV (2026-08-18) — this is being exploited in the wild.
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2026-59310.

What it is

CVE-2026-59310 is a path traversal vulnerability in Broadcom VMware vCenter. It has a CVSS score of 9.8 (Critical), with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — meaning it is reachable over the network, requires low attack complexity, needs no privileges and no user interaction, and results in full compromise of confidentiality, integrity and availability.

The flaw sits in vCenter itself. Broadcom describes it as allowing a threat actor with network access to vCenter to execute arbitrary code. Given the CVSS vector, no authentication is required to trigger it — network reachability to vCenter is sufficient.

The vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalogue, added on 18 August 2026, so it is known to be exploited.

The advisory does not currently list fixed releases, and no further advisory detail has been published beyond the summary above.

What to do

  • Treat vCenter as a priority patching target. Consult Broadcom’s advisory directly for fixed releases as they become available, since none are listed at present.
  • Restrict network access to vCenter to the minimum required set of management hosts and jump boxes; it should not be reachable from general user networks or the internet.
  • Given the KEV listing, follow your organisation’s expedited remediation process for known-exploited vulnerabilities rather than standard patch cycles.
  • Review vCenter access logs for anomalous requests, particularly those consistent with path traversal patterns, while awaiting a fix.
  • Once Broadcom publishes fixed releases, apply them promptly and confirm the version against the advisory rather than relying on this summary.

For leadership 🧭

Executive summary. Risk is Critical (CVSS 9.8) across any Broadcom kit you run. Follow the remediation in the vendor advisory within Immediate — CISA KEV entries carry a federal remediation deadline.

Why it matters:

  • Exposure depends on deployment topology and which access paths reach the affected component.
  • Treat internet-facing and management-plane instances as higher risk than internal-only ones.
  • Keep monitoring for abnormal authentication and configuration events until upgrades complete.

Now / Next / Later:

  • Now: confirm whether you run the affected versions, and check exposure of any that are internet-facing.
  • Next: apply the remediation the advisory specifies, through an approved change window.
  • Later: add a control check so builds cannot drift back onto a vulnerable train.

Source