VMware vCenter CVE-2026-59310 and CVE-2026-59309: syslog path traversal to root RCE and LDAP login bypass, exploited

What happened

On 29 July 2026, Broadcom published VMSA-2026-0006 with two critical vCenter bugs, both CVSS 9.8, and no workarounds (Broadcom). Matt South and Phil Brass of Atredis Partners reported them on 9 July and published details on 29 July (Atredis).

• CVE-2026-59310: syslog directory traversal. The vCenter Server Appliance accepts syslog on UDP and TCP port 514 and TCP port 1514. Its rsyslog configuration writes each message to /var/log/vmware/esx/<hostname>/<hostname>-syslog.log, and rsyslogd does not clean the hostname. A hostname with ../ sequences writes a file anywhere on disk, as root. Atredis chained this with the vmware-pod service on TCP 5580, which runs a root wrapper that sources /etc/profile, to get code execution as root (Atredis).
• CVE-2026-59309: login without a password. vCenter’s directory service (vmdird) supports SRP authentication through the Cyrus SASL library, which never implemented a check the SRP specification requires. An attacker needs only a valid account name, and administrator@<sso-domain> can be read anonymously. With it they can create an admin user and manage the cluster (Atredis).

Exploitation. On 11 August, Defused Cyber reported a spike in scanning that may target CVE-2026-59309. Its honeypots logged POST /sdk/ version probes and walks of the /websso SAML flow (The Hacker News). QUIRSO GmbH reported in-the-wild exploitation of both CVEs (Greenbone). Its report is titled as covering 361 victim IPs across 47 countries, and a follow-up is titled as linking the activity to a suspected China-nexus APT. We could not open the QUIRSO posts, so we cannot confirm their details.

On 13 August, Shadowserver sent a special report on QUIRSO’s CVE-2026-59310 victims. It says a reverse_ssh persistence tool was deployed on all reported victims and that they “should be considered fully compromised”. Its sample rows show activity on 3 August (Shadowserver).

CISA added CVE-2026-59310 to KEV on 18 August 2026 and marks it as known to be used in ransomware campaigns (CISA KEV). CVE-2026-59309 was not in KEV as of the 30 October catalog.

Also in KEV: CVE-2026-41709. The same advisory fixed a low-severity (CVSS 2.7) ESX logging gap: a malicious administrator can perform some operations without them being logged (Broadcom). CISA added it to KEV on 28 October 2026 (CISA KEV). It does not give access on its own; it lets an attacker who already has ESX admin act without leaving a trail.

Am I affected?

Affected vCenter lines, per the CVE records and Broadcom (CVE-2026-59310; Broadcom):

Check the running build. On the appliance shell, or through the VAMI page on port 5480:

vpxd -v

With PowerCLI:

$global:DefaultVIServers | Select-Object Name, Version, Build

Then look for signs of the file-write trick described by Atredis. These checks follow from its write-up; they are not vendor IOCs:

# Hostname folders that should only ever be ESX host names
ls -la /var/log/vmware/esx/

# Files recently dropped where root shells source them
ls -lat /etc/bash_completion.d/ /etc/profile.d/ | head -20

If you get Shadowserver reports, search them for the tag cve-2026-59310-exploitation or the infection reverse_ssh (Shadowserver).

What to do now

1. Patch vCenter to 8.0 U3k (or 8.0 U2f), 9.0.2.0100 or 9.1.0.0300. Broadcom lists no workaround for either CVE (Broadcom).
2. Until you can patch, cut off the syslog ports. Atredis names UDP/TCP 514, TCP 1514 and TCP 5580 as the path to root (Atredis). Allow them only from your ESX hosts. This is our reading of the write-up, not Broadcom guidance, and it does nothing for CVE-2026-59309.
3. Treat a listed or suspicious vCenter as compromised. Shadowserver says the reported victims had reverse_ssh installed (Shadowserver). Rebuild the appliance from a clean image rather than patching in place. Review SSO users and anyone holding the Administrators role, since CVE-2026-59309 lets an attacker add an admin.
4. Patch ESX for CVE-2026-41709: ESXi80U3j-25429389, ESXi-9.0.2.0100-25595025, ESXi-9.1.0.0-25370933, or VCF 5.2.4 (Broadcom). While you are there, take ESXi80U3k-25595708 or later for the VMXNET3 VM escape CVE-2026-47876 from the same advisory.
5. Assume ESX audit logs are incomplete for any host an attacker may have reached through vCenter. CVE-2026-41709 lets an admin skip logging, so a clean log is weak evidence.

Sources

• Broadcom: VMSA-2026-0006
• Atredis Partners: ATREDIS-2026-0008, vCenter Server Appliance multiple critical vulnerabilities
• Shadowserver: VMware vCenter CVE-2026-59310 exploitation victim special report
• Greenbone: two actively exploited CVEs affecting VMware vCenter Server
• The Hacker News: three critical VMware flaws
• CVE-2026-59310 record
• CVE-2026-59309 record
• CISA Known Exploited Vulnerabilities catalog