TL;DR

CVE-2026-59310 is a CVSS 9.8 path traversal in the VMware vCenter Syslog server. An unauthenticated attacker with network access to port 443 can traverse directories and write arbitrary files, resulting in remote code execution. CISA added it to the KEV catalog on August 18 with a due date of August 21 — three days later. If you run vCenter with the default Syslog service exposed, you are in the blast radius.

The Vulnerability

VMware published the advisory on or about August 14, and NVD confirmed the details:

VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8 — Critical)

CWE: CWE-22 (Path Traversal)

The Syslog server component in vCenter accepts file uploads for log collection. The path validation only strips the first ../ segment, allowing a crafted filename like ../../tmp/malware.sh to escape the designated log directory. From there, an attacker can drop a shell script or JSP payload into a writable path and trigger execution — effectively giving them a shell on the vCenter appliance.

Why 9.8, Not 9.1

A 9.8 requires three conditions:

  1. Network-attackable — the Syslog service listens on port 443 by default
  2. Low complexity — just a crafted filename in the upload endpoint
  3. No auth required — the upload endpoint doesn’t check session tokens before validating the path

The “scope unchanged” part is worth calling out. This is a single-host RCE, not a pivot. The attacker gets a shell on the vCenter appliance (typically a hardened Linux VM), not a hop into the vSphere cluster. But a vCenter shell means you can read vCenter’s database, manipulate host credentials, and push updates to any ESXi host. That’s plenty to make a CISO nervous.

Affected Versions

Broadcom’s advisory (support.broadcom.com) covers:

  • VMware vCenter Server 8.0 U2e and earlier (unfixed)
  • VMware vCenter Server 8.0 U3 (unfixed)
  • VMware vCenter Server 8.0 U4 (unfixed)
  • VMware vCenter Server 8.0 U5 (unfixed)
  • VMware vCenter Server 8.0 U6 (unfixed)

Check the advisory for version-specific fix information. If the Syslog service is not used, disabling it is an acceptable interim mitigation.

CISA Due Date — Today

Event Date Days ago
CVE disclosed ~Aug 14 7
CISA added to KEV Aug 18 3
KEV due date Aug 21 0 (today)

Three days from KEV to due date is one of the shortest windows CISA assigns. It signals that the exploit is simple, the target is high-value, and exploitation is already occurring in the wild.

What To Do

  1. Check if vCenter is in scope. Run systemctl status vmware-vpxd-syslog-collector on the appliance. If it’s running, the Syslog service is active.
  2. Check network exposure. Run netstat -tlnp | grep 443 on the appliance and check the firewall rules. If port 443 is open to the external network, the attack surface is wider.
  3. Apply the Broadcom patch. See the advisory linked above for the fixed build number.
  4. Interim mitigation. If patching takes time, disable the Syslog service: systemctl disable --now vmware-vpxd-syslog-collector. This removes the upload endpoint and eliminates the path traversal vector.
  5. Verify. After patching, send a crafted upload with a ../../etc/vmware-vpx/ path segment and confirm the file lands in the expected directory, not outside it.

The Pattern

This is the same story we saw two weeks ago with Cisco ASA/FTD (CVE-2026-20349, KEV due Aug 14) and again last week with TeamCity (CVE-2026-63077). Broadcom/VMware publishes a critical advisory, CISA adds it to KEV with a tight window, and the exploit lands in the wild within days. The difference with vCenter is the target density: almost every enterprise with a virtualized infrastructure runs at least one vCenter server, and most have it internet-facing for remote management.

vCenter has been a KEV magnet. The last several years of VMware advisories have produced at least five KEV entries: CVE-2021-21972 (RCE in vSphere Client plugin), CVE-2021-21985 (VSAN plugin RCE), CVE-2021-22005 (file upload RCE), CVE-2020-3992 (ESXi OpenSLP UAF), and now CVE-2026-59310. If your org hasn’t patched vCenter in a while, today’s KEV due date is a good reminder.

References