Broadcom VMware vCenter Path Traversal Vulnerability (CVE-2026-59310): Action Required

An unauthenticated threat actor with network access to a Broadcom VMware vCenter server can execute arbitrary code on the underlying operating system by exploiting a critical path traversal vulnerability designated as CVE-2026-59310. Holding a maximum CVSS score of 9.8, the flaw presents an immediate threat to virtualized enterprise infrastructure. Organizations running vSphere environments must prioritize addressing this Broadcom VMware vCenter path traversal vulnerability before attackers integrate it into automated exploitation routines.

Technical Mechanics and Attack Path

Tracked under weakness class CWE-22, the flaw stems from inadequate path sanitization within vCenter’s handling of incoming HTTP requests. The vector metrics—CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H—tell a clear story: the vulnerability is reachable over the network, demands zero privileges, requires no user interaction, and carries low attack complexity.

In practice, path traversal vulnerabilities in vCenter management services typically allow attackers to escape the intended web root or endpoint directory by supplying sequences such as ../ or URL-encoded variants (%2e%2e%2f). In an unauthenticated remote code execution scenario, an attacker leverages file-write or file-upload primitives through the traversed path to place malicious payloads—such as web shells or modified service configurations—directly into web-accessible directories or cron schedules. Once written, executing the payload grants the attacker code execution under the context of the vCenter service account (such as vsphere-ui or root), providing complete control over the appliance.

Threat Context: Why EPSS Shouldn’t Cause Complacency

At the time of writing, the Exploit Prediction Scoring System (EPSS) measures the probability of exploitation in the next 30 days at 1.1%, placing it in the 63.9th percentile. While a 1.1% figure might appear modest compared to widely exploited perimeter bugs, treating vCenter vulnerabilities as low priority based on early EPSS scores is a dangerous mistake.

vCenter Server is the administrative heart of the virtual infrastructure. Threat actors—particularly human-operated ransomware groups and state-sponsored intrusion sets—frequently hunt for vCenter instances once inside a network perimeter. Gaining system-level control of vCenter gives attackers direct visibility into all managed ESXi hosts, storage datastores, and virtual machines. From there, adversaries routinely conduct lateral movement, destroy virtual machine snapshots, or deploy hypervisor-level ransomware across the entire virtual fleet.

Even if active exploitation is not yet widespread, the low attack complexity means weaponized proof-of-concept exploits can circulate quickly.

Forensic Triage and Remediation

Federal enterprise networks face a CISA Binding Operational Directive (BOD) 26-04 remediation deadline of August 21, 2026, though commercial security teams should align with the same urgency.

To secure your environment, execute the following steps:

1. Apply Vendor Patches: Upgrade VMware vCenter Server to the fixed release versions specified in Broadcom’s official security advisory. If immediate patching is constrained by operational windows, evaluate temporary vendor-supplied mitigations, though patching remains the only permanent fix.
2. Isolate Management Interfaces: Verify that vCenter administrative ports (including HTTPS 443) are strictly restricted to isolated administrative VLANs or secure jump boxes. No vCenter instance should ever be directly exposed to the public internet.
3. Perform Forensic Triage: Before applying patches, run forensic checks to confirm the appliance has not already been compromised.
   • Inspect vCenter web server logs (such as /var/log/vmware/vSphere-ui/ and /var/log/vmware/vsphere-client/) for anomalous HTTP POST or GET requests containing directory traversal sequences (../, ..%2f, %2e%2e%2f).
   • Audit webroot paths and temporary directories (/tmp, /var/tmp, /usr/lib/vmware-vsphere-ui/) for newly created, unexpected .jsp, .war, or executable files.
   • Review local user accounts and scheduled tasks on the vCenter appliance for unauthorized persistence mechanisms.