VMware vCenter Flaw Actively Exploited: Patch Now

VMware vCenter is the management hub for many businesses’ server virtualisation environments. If your organisation runs multiple virtual servers — common in accountancy practices, manufacturers, and any business that has moved away from physical hardware — there is a good chance vCenter sits at the centre of it.

On 29 July 2026, Broadcom published security advisory VMSA-2026-0006.1, disclosing two critical vulnerabilities in vCenter Server and related products. One of them — CVE-2026-59310 — was being actively exploited within five days of disclosure. The US Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities catalogue on 18 August 2026. There is no workaround: the only fix is to apply the patch.

What is the vulnerability?

CVE-2026-59310 is a path traversal flaw in vCenter’s Syslog component, rated CVSS 9.8 out of 10 — the highest critical range. A path traversal vulnerability means an attacker can send specially crafted requests that trick the server into accessing files or executing code outside the directories it is supposed to touch. In this case, an attacker with network access to vCenter — and without needing to log in first — can exploit the flaw to run arbitrary code on the host. In plain terms: if someone can reach your vCenter management interface over the network, they may be able to take control of it.

A companion flaw, CVE-2026-59309 (also CVSS 9.8), provides an authentication bypass in the VMware Directory Service. The two vulnerabilities can be chained together, making the overall exposure more serious.

Which products are affected?

• VMware vCenter Server 8.0 (all update streams up to and including Update 3j)
• VMware vSphere Foundation (all releases)
• VMware Cloud Foundation
• VMware Telco Cloud products

Broadcom has confirmed there is no workaround for CVE-2026-59310. Patching is the only remediation. For most environments, the fix is to update to vCenter Server 9.1.0.0300 or the equivalent patched build for your version, as detailed in VMSA-2026-0006.1. Patches are available through the Broadcom Support Portal for customers with an active support entitlement.

Why does this matter to your business?

Security researchers tracking the exploitation identified 361 unique victim IP addresses across 47 countries within weeks of disclosure. The attack pattern observed involved establishing persistent remote access using an open-source SSH tunnelling tool — meaning attackers are not simply probing; they are setting up long-term footholds inside affected environments.

vCenter is effectively the master key to your virtual infrastructure. An attacker who gains control of vCenter can access, clone, snapshot, or destroy every virtual machine it manages. For a business where virtual servers host databases, line-of-business applications, or financial records, that represents a serious data protection and business continuity risk — exactly the scenario our IT security work is designed to prevent.

What should you do now?

If your business runs VMware vCenter, the priority actions are:

1. Confirm your version. Log in to the vCenter Server Management Interface and note the build number. Cross-reference it against Broadcom advisory VMSA-2026-0006.1 to confirm whether you are running a vulnerable build.
2. Apply the patch without delay. Update to vCenter Server 9.1.0.0300 or the patched build for your version. Follow Broadcom’s upgrade documentation; vCenter updates generally require a short maintenance window.
3. Check network exposure. The vCenter management interface (typically on port 443 or 9443) should never be directly accessible from the internet. If it is, restrict it to a management VLAN or require VPN access before addressing it through the management interface.
4. Review logs for signs of activity. Look for unusual events in vCenter logs and firewall logs from 3 August 2026 onwards, particularly any unfamiliar outbound SSH connections or new scheduled tasks.

What we have already done

If you are a managed services client with System Force, we are already reviewing vCenter environments under our management remit. If you manage your own infrastructure, or use a mix of supported and self-managed systems, we can carry out a rapid assessment and advise on patching and exposure.

Vulnerabilities of this severity in core infrastructure components are exactly why proactive patch management matters. Our IT support and maintenance service includes patch management as a standard component, so your systems stay current without you needing to track every advisory yourself.

For a broader review of your virtualisation and server security posture, our managed IT services team is here to help. If you would like to talk through your setup, get in touch or call 01452 701355 for a no-obligation conversation.