The Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency binding operational directive adding CVE-2026-59310 to its Known Exploited Vulnerabilities catalog. The security defect impacts Broadcom VMware vCenter Server and VMware Cloud Foundation, the centralized management platform that orchestrates enterprise ESXi hypervisor clusters, software-defined storage, and cloud virtualization infrastructure globally.
Holding a maximum-criticality CVSS v3.1 base score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the vulnerability enables an unauthenticated attacker with network access to vCenter Server over HTTPS (port 443) to execute arbitrary operating system commands with root privileges on the vCenter Server Virtual Appliance (vCSA) underlying Photon OS host.
Vulnerability Deep Dive: Path Traversal in Distributed Cluster Service Ingestion
According to technical vulnerability advisories released by Broadcom and virtualization security researchers, the flaw resides in the internal Distributed Cluster Services (DCS) and telemetry logging endpoints exposed by the vCenter reverse proxy:
- Unauthenticated Endpoint Access: The vCenter Envoy reverse proxy maps external HTTPS requests directed to specific cluster monitoring URIs to internal Java microservices without requiring prior session authentication tokens.
- Canonicalization Breakdown: When ingesting incoming file management or cluster bundle synchronization requests, the backend service fails to properly resolve canonical file paths, permitting encoded directory traversal sequences (such as
..;/..;/or URL-encoded slashes). - Arbitrary File Write to Command Execution: An attacker exploits the path traversal to write arbitrary payload files into root-controlled system directories (such as cron directories or internal service plugin paths). The injected scripts execute automatically, yielding an unprivileged-to-root interactive command shell on the appliance.
vCenter Server is the architectural linchpin of corporate virtualization. A root compromise of vCenter provides threat actors with unrestricted control over every virtual machine, VM snapshot, domain controller, and storage datastore connected to the virtualization fabric.
Affected Software & Remediated Release Matrix
| VMware Platform / Product | Vulnerable Release Branches | Remediated Maintenance Release | CISA Remediation Mandate |
|---|---|---|---|
| VMware vCenter Server 8.0 | 8.0 through 8.0 U3b | vCenter Server 8.0 U3c or later | Emergency Directive Action Required |
| VMware vCenter Server 7.0 | 7.0 through 7.0 U3r | vCenter Server 7.0 U3s or later | Emergency Directive Action Required |
| VMware Cloud Foundation (VCF) | 5.x and 4.x branches | Apply Asynchronous Patch via SDDC | Mandatory Patch Deployment |
Detection, Audit & Hardening Commands
Datacenter administrators and SOC analysts must execute the following triage commands directly on vCSA console sessions:
# Connect via SSH to the vCenter Server Virtual Appliance shell
ssh root@vcenter.corp.internal
# Verify current vCenter Server build version
vpxd -v
# Inspect vCenter reverse proxy and Tomcat logs for traversal sequences
grep -iE "(../|..\|%2e%2e%2f)" /var/log/vmware/envoy/envoy-access.log
grep -iE "DCS|cluster-sync" /var/log/vmware/vpxd/vpxd.log | grep -E "error|exception"
# Check for newly modified files in root cron directories
find /etc/cron* -type f -mtime -5
Recommended Enterprise Safeguards
- Deploy Broadcom Emergency Updates: Update vCenter Server instances to version 8.0 U3c or 7.0 U3s immediately via the vCenter Server Management Interface (VAMI, port 5480).
- Isolate Management Networks: Ensure vCenter management interfaces are placed strictly within isolated out-of-band management subnets with zero direct inbound access from corporate user VLANs or the internet.
- Audit Virtual Machine Snapshots: Review active VM snapshots and administrative role assignments for unauthorized accounts created prior to patch deployment.
