​Broadcom warned today that attackers are now exploiting two VMware vCenter Server vulnerabilities, one of which is a critical remote code execution flaw.

CVE-2026-59309 & CVE-2026-59310: patch-diffing VMware vCenter reveals two pre-auth 9.8 bugs - an auth bypass and a syslog path traversal to RCE.

You start a vCenter upgrade, watch the progress, and hope this will be one of those maintenance windows where everything finishes on time. Then the database upgrade fails. That is what I ran into while upgrading VMware vCenter Server to 9.1.0.0300. The blocker was an orphaned record in the vCenter database, sitting right where the upgrade needed to enforce a foreign key relationship.

If you didn't fix this a month ago, your to-do list probably needs a reshuffle Two VMware vCenter server bugs, including a critical heap-overflow vulnerability that leads to remote code execution (RCE), have been exploited in attacks after Broadcom’s…

VMoreCloud Learn | Build | Share ⌂ Home › Software › Virtualization › VMware vCenter Converter VMware vCenterConverter Standalone6.6.0 P2V • V2VMigration VMware Migration Utility VMware vCenter Converter Standalone 6.6.0 A practical migration utility for supported physical-to-virtual and virtual-to-virtual conversion workflows. Use it as part of a structured VMware migration plan for server consolidation, hardware refreshes, data-center modernization and supported hypervisor migrations.

If you didn't fix this a month ago, your to-do list probably needs a reshuffle

Two pre-authentication vulnerabilities have been discovered in VMware vCenter through patch-diffing, identified as CVE-2026-59309 and CVE-2026-59310. Both vulnerabilities are rated 9.8 in severity. The first is an authentication bypass, and the second is a syslog path traversal vulnerability that leads to remote code execution.

U.S. CISA adds Apple macOS, Microsoft SharePoint, VMware vCenter, and Microsoft IKE flaws to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency has added a critical Broadcom VMware vCenter vulnerability, tracked as CVE-2026-59310 , to its Known Exploited Vulnerabilities catalog after evidence showed active exploitation in attacks. The flaw affects VMware vCenter and is classified as a path traversal vulnerability under CWE-22. According to CISA, an attacker with network access to a vulnerable vCenter instance could exploit the issue to execute arbitrary code. This poses a serious risk to organizations running VMware virtual infrastructure, particularly when vCenter servers are exposed to untrusted networks or accessible via compromised internal accounts. Path traversal flaws occur when an application fails to validate user-provided file paths properly. An attacker may abuse specially crafted path values to access files or directories outside the intended location. VMware vCenter Path Traversal Vulnerability Exploited In this case, successful exploitation could allow an intruder to bypass normal access controls and gain code execution on the vCenter environment. VMware vCenter is a high-value target because it centrally manages virtual machines, hosts, datastores, networking, and access controls. Attackers who gain control of a vCenter server may be able to disrupt many workloads, change virtual machine settings, deploy malicious virtual machines, steal credentials, or turn off recovery operations. CISA added CVE-2026-59310 to the KEV catalog on August 18, 2026. Federal civilian executive branch agencies must apply required mitigations by August 21, 2026, under Binding Operational Directive 26-04. The short remediation window reflects the risk posed by the exploitation of vulnerable infrastructure management systems. The agency said organizations should apply mitigations in line with Broadcom’s vendor instructions and evaluate every affected asset for internet exposure. Organizations must also follow CISA’s BOD 26-04 guidance for prioritizing security updates based on risk, as well as its forensics triage requirements. Where mitigations are not available, CISA advises affected stakeholders to discontinue use of the vulnerable product. CISA has not indicated whether CVE-2026-59310 has been used in ransomware operations. However, VMware management platforms have repeatedly been targeted in enterprise intrusions because they offer attackers broad control over virtualized environments. Security teams should immediately identify all vCenter deployments , confirm their software versions, and determine whether exposed systems are reachable from the internet or from less-trusted internal network segments. Administrators should restrict management access to approved networks, enforce multi-factor authentication, review privileged vCenter accounts, and inspect logs for suspicious authentication events or abnormal administrative activity. Organizations should also preserve relevant vCenter, hypervisor, identity, and network logs before patching if compromise is suspected. Rapid containment and forensic review are important because a successful attack against a virtualization management platform can have consequences across the entire data center.  Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. ->  Integrate ANY.RUN With Your SOC  Now . The post CISA Warns of VMware vCenter Path Traversal Vulnerability Actively Exploited in Attacks appeared first on Cyber Security News .

Die IT-Sicherheitsbehörde CISA warnt aktuell vor Angriffen auf Microsoft IKE, SharePoint, VMware vCenter und macOS.

The saga of VMWare’s critical CVE-2024-38812 vCenter Server bug has reached the “exploitation detected” stage.

CISA adds four critical flaws to KEV after active exploitation, with FCEB agencies ordered to patch by August 21, 2026

If you skipped it back then, now’s a very good time You've got to keep your software updated. Some unknown miscreants are exploiting a critical VMware vCenter Server bug more than a year after Broadcom patched the flaw.…

Broadcom patches critical VMware vCenter Server vulnerability, CVE-2024-38812, preventing remote code execution. Update now.

​Broadcom warned today that attackers are now exploiting two VMware vCenter Server vulnerabilities, one of which is a critical remote code execution flaw.

Cómo configurar un clúster de virtualización VMware vCenter y sus respectivos hosts hipervisores ESXi para reenviar los log a un servidor de syslog externo. Requisitos para enviar los logs de VMware v...

YouTube video by 2GuysTek

A recently patched critical vulnerability (CVE-2026-59310) in VMware vCenter Syslog Server is being exploited in an active campaign to deploy a reverse SSH tool for persistence and remote access.