CISA added CVE-2026-59310 on 18 August 2026. Its record says a network-reachable VMware vCenter path traversal vulnerability could allow code execution and records known ransomware campaign use as known.
Key takeaways
- vCenter controls virtualization infrastructure, so impact assessment should include management-plane access and credentials.
- Apply Broadcom guidance, verify exposure, and investigate the management plane when the vulnerable service was reachable.
Management platforms concentrate privileged actions. A vulnerability affecting vCenter deserves a separate review of administrative access, automation credentials and recovery capability.
This historical article records the public CISA and Broadcom references; it does not claim a particular vCenter deployment was compromised.
What the sources establish
CISA records CVE-2026-59310 as a vCenter path traversal vulnerability, its date of addition and known ransomware campaign use. Broadcom's advisory is the authority for affected releases and mitigations.
Defensive checks
Identify every vCenter instance and its reachability, apply the vendor mitigation, review privileged logins, API use and new automation accounts, and confirm that recovery procedures protect the management plane as well as guest workloads.
Sources
A verified update is necessary; it is not evidence that earlier management-plane activity was benign.
Editorial feedback
Have a correction or additional primary evidence? Contact the editorial team and include this article’s URL.