Exploited vulnerabilitiesBriefConfirmed by two or more outlets
VMware vCenter Syslog directory traversal to RCE (CVE-2026-59310, plus CVE-2026-59309)
VMSA-2026-0006, 29 Jul 2026. CVSS 9.8.
- Disclosed
What happened
- Exploitation 3 to 7 Aug: 361 victim IPs across 47 countries (single-vendor figure). KEV: 18 Aug 2026.
- Fixed: 8.0 U3k and 9.0.2.0100.
- Also VMware ESX CVE-2026-41709 (insufficient logging), KEV 28 Oct 2026.
Live scores
Live scores
CVE-2026-41709- EPSS
- 0.007
low predicted chance of attack - VEDAS
- 0.513
some exploit evidence - On CISA KEV
- Yes, since 2026-10-28
- Detection rule
- None yet
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish. The vertical line is the day CISA added it to its exploited list.
Live scores
CVE-2026-59309- EPSS
- 0.006
low predicted chance of attack - VEDAS
- 0.412
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- None yet
Live scores
CVE-2026-59310- EPSS
- 0.026
some chance of attack soon - VEDAS
- 0.987
strong exploit evidence - On CISA KEV
- Yes, since 2026-08-18
- Detection rule
- Suricata
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish. The vertical line is the day CISA added it to its exploited list.
Sources
- https://www.greenbone.net/en/blog/patch-now-two-actively-exploited-cves-affecting-vmware-vcenter-server-and-more/
- https://thehackernews.com/2026/07/three-critical-vmware-flaws-allow-auth.html
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.