CVE-2026-59310 Broadcom VMware vCenter Path Traversal

What is CVE-2026-59310?

CVE-2026-59310 is a critical path traversal vulnerability in Vmware Vcenter Server, published on 30 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.

Weakness: CWE-22

Which versions are affected by CVE-2026-59310?

It affects 1 product.

Products include Vmware Vcenter Server.

How do I fix CVE-2026-59310?

No fix has been published for CVE-2026-59310 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 21 Aug 2026.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-59310 being exploited?

Yes. Attackers have exploited CVE-2026-59310 in the wild since at least 18 Aug 2026, including in ransomware campaigns.

Public exploit code: 5 proofs of concept on GitHub.

Other vulnerabilities in Vmware Vcenter Server

• CVE-2023-34048 VMware vCenter Server Out-of-Bounds Write Exploited Critical 9.8
• CVE-2020-3952 VMware vCenter Server Information Disclosure Exploited Critical 9.8
• CVE-2021-22017 VMware vCenter Server Improper Access Control Exploited Medium 5.3
• CVE-2015-2342 Code injection in n/a Critical 10.0
• CVE-2026-59309 vCenter authentication-bypass vulnerability Critical 9.8

All Vmware Vcenter Server vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-v2gp-49gj-2c9f.