CVE-2026-59310

Think of vCenter as the “control room” for your virtualization and infrastructure management. This vulnerability lets an attacker use a crafted message to trick the Syslog server into reaching files or paths it shouldn’t, which can lead to attackers running harmful code. If an attacker can reach it, it can turn your control room into a target—like someone finding a hidden door to walk straight into the server’s most sensitive areas.

This matters if you run VMware vCenter (including Cloud Foundation, vSphere Foundation, Telco Cloud Infrastructure, and Telco Cloud Platform deployments that include vCenter components). It’s most relevant to you if your vCenter Syslog server is reachable from a network an attacker could access (for example, a broader internal network segment or anything internet-facing). The risk is tied to reachability: it’s a problem when an attacker can connect to vCenter’s Syslog server over the network.

This is RED because reporting attributes exploitation activity to an APT actor and the coverage is described as sustained. Even without public exploit code, directory-traversal issues in management systems like vCenter are high value, and attackers can use them to gain serious control. Act now to remove network exposure and upgrade to the fixed vCenter versions.

Confirm whether we’re exposed

1. Identify the exact VMware vCenter version currently deployed.
2. Determine whether the Syslog server function inside vCenter is reachable from any network not tightly controlled for administration.
   • Focus on whether connections can originate from untrusted segments or from the internet.
   • If you use external logging/forwarders, confirm the allowed sources are limited to those systems.

Patch to a fixed release

Upgrade vCenter to one of the known fixed versions:

• vCenter fixed in 9.1.0.0300
• vCenter fixed in 9.0.2.0100
• vCenter fixed in 8.0 U3k

Branch guidance (to avoid the wrong upgrade path):

• If you are on the 9.1 line, target 9.1.0.0300.
• If you are on the 9.0 line, target 9.0.2.0100.
• If you are on the 8.0 line, target 8.0 U3k.

If you can’t patch immediately (temporary risk reduction)

1. Block network paths that allow access to vCenter’s Syslog server from untrusted networks.
2. Restrict connectivity so only required logging/admin systems can reach it.
3. Add/confirm firewall rules and network ACLs so this endpoint is not reachable broadly.

Validate after upgrading

1. Re-check that the vCenter version matches the fixed release you selected.
2. Review vCenter appliance and Syslog-related logs for errors around the Syslog server activity.
3. Confirm the Syslog service continues to function for your intended log sources.

What to monitor over the next days

• Unexpected Syslog server errors or repeated failed requests.
• Unexpected changes in vCenter behavior (service restarts, unusual process activity) that coincide with Syslog traffic.

KEV / timing note

CISA KEV listing was not found in the provided findings, so there is no KEV-based due date to follow here; prioritize the upgrade based on active exploitation reporting.

CVE-2026-59310 is a directory-traversal vulnerability in the VMware vCenter Syslog server (CWE-22). The practical issue described for this CVE is that an attacker with network access can exploit crafted input to traverse beyond intended directories/paths, enabling arbitrary code execution. The provided findings report sustained press attention with exploitation attributed to an APT actor, which indicates real-world attacker interest.

Exploitation status: sustained reporting indicates exploitation is occurring in the wild; no public exploit code was found in the provided findings.

Attack vector / reachability: network-reachable vCenter where the Syslog server can be reached by an attacker.

Fix availability: known fixed vCenter versions are 9.1.0.0300, 9.0.2.0100, and 8.0 U3k.

Predicted likelihood (not used for urgency): EPSS was provided as a prediction only; the verdict prioritizes exploitation reporting over prediction.