Unauthenticated Path Traversal to Code Execution in VMware vCenter (CVE-2026-59310)
CISA added this unauthenticated vCenter code-execution flaw to KEV today with a 2026-08-21 deadline and VulnCheck records known ransomware use, so an unpatched vCenter reachable by attackers is a direct path to full-hypervisor-estate compromise this week.
A path traversal vulnerability in VMware vCenter allows an attacker with network access to vCenter to execute arbitrary code without credentials, granting control of the virtualization management plane and everything it manages. Exploitation has been linked to ransomware operations.
Affected: VMware vCenter 9.1.x < 9.1.0.0300; VMware vCenter 9.0.x < 9.0.2.0100; VMware vCenter 8.0 < 8.0 U3k; VMware Cloud Foundation 5.x, 9.0.x, 9.1.x; VMware vSphere Foundation 9.0.x, 9.1.x; VMware Telco Cloud Platform 5.1.x; VMware Telco Cloud Infrastructure 3.0
How to Test
Check the vCenter build in the vSphere Client (Help > About) or via `vpxd -v` on the appliance; anything below 8.0 U3k, 9.0.2.0100, or 9.1.0.0300 is vulnerable. Verify whether vCenter (port 443) is reachable from untrusted networks, and review vCenter access logs (/var/log/vmware/) for requests containing traversal sequences (../) or unexpected file paths.
How to Patch
Apply the VMSA-2026-0006 updates: upgrade vCenter to 8.0 U3k, 9.0.2.0100, or 9.1.0.0300 as appropriate, and apply the corresponding Cloud Foundation / vSphere Foundation / Telco Cloud async patches. Broadcom lists no workaround, so if immediate patching is impossible, restrict network access to vCenter to a dedicated management network or VPN and treat any exposed instance as potentially compromised, following CISA's forensics triage guidance.