CVE-2026-59310: Broadcom VMware vCenter Syslog Path Traversal RCE (KEV)

CVE-2026-59310 is a directory-traversal vulnerability (CWE-22) in the Syslog server of Broadcom VMware vCenter that lets any attacker with network reachability to vCenter — no credentials, no privileges — execute arbitrary code, and it was already under active exploitation, including by a suspected China-nexus group, before CISA added it to the KEV catalog with a 3-day remediation window.

CVE-2026-59310 affects Broadcom VMware vCenter, the centralized management server for vSphere environments. NVD's description states: "VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code" (NVD).

The only CVSS metric NVD records is the CNA-submitted (Secondary, not NVD Primary) score from VMware's own security team: CVSS v3.1 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low complexity, no privileges or user interaction required (NVD).

Broadcom's advisory VMSA-2026-0006 (now at revision .2) covers five CVEs across VMware ESX, vCenter, Workstation, Fusion, Cloud Foundation, vSphere Foundation and Telco Cloud Platform. For CVE-2026-59310 specifically, Broadcom's own text matches NVD and adds: "Resolution: To remediate CVE-2026-59310 apply the patches listed in the 'Fixed Version' column of the 'Response Matrix'... Workarounds: None." The Response Matrix lists vCenter/VCF 9.1.x fixed in 9.1.0.0300, 9.0.x fixed in 9.0.2.0100, 8.0 fixed via the standard vSphere 8.0 update/patch stream, and 7.0 as out of general support ("Contact Broadcom Support if you have extended support contract"). Broadcom credits Phil Brass and Matt South of Atredis Partners for reporting the issue (Broadcom Security Advisory VMSA-2026-0006).

CISA added CVE-2026-59310 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-08-18, with a required-action due date of just 2026-08-21 (3 days) and "Known" recorded under knownRansomwareCampaignUse — the shortest and most urgent category CISA uses, reflecting that in-the-wild exploitation was already confirmed and tied to ransomware-adjacent intrusion activity at the time of listing (CISA KEV).

As of 2026-10-27, FIRST scores the probability of exploitation at 0.02565 (85.039th percentile) — moderate relative to the broader CVE population, but the KEV listing and "Known" ransomware-campaign-use flag are the stronger signals here given vCenter's position as the single point of control for an entire virtualization estate (FIRST EPSS).

Because there is no workaround and exploitation is already confirmed, any vCenter instance reachable from an untrusted network should be patched to the fixed build immediately and reviewed for the log/process indicators Broadcom's advisory and incident responders have associated with this campaign.

• Directory traversal (CWE-22) in vCenter's Syslog server lets a network-reachable, unauthenticated attacker execute arbitrary code. — NVD
• CVSS v3.1 base score 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) is VMware's own CNA-submitted score, stored by NVD as a Secondary (not Primary/NVD-confirmed) metric. — NVD
• Broadcom advisory VMSA-2026-0006.2: no workaround exists; Response Matrix gives fixed builds per branch (VCF 9.1.0.0300, 9.0.2.0100, vSphere 8.0 patch stream; 7.0 out of general support); credited to Phil Brass and Matt South of Atredis Partners. — Broadcom Security Advisory VMSA-2026-0006
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-08-18, required action due 2026-08-21, known ransomware campaign use recorded as "Known". — CISA KEV
• EPSS score is 0.02565 (85.039th percentile) as of 2026-10-27. — FIRST EPSS