vCenter: two critical vulnerabilities, one already exploited in attacks
Broadcom fixed two 9.8-rated flaws in vCenter —an authentication bypass and a directory traversal— and weeks later attacks against one of them were confirmed.
What happened
Broadcom published advisory VMSA-2026-0006 with fixes for two vulnerabilities rated CVSS 9.8: an authentication bypass in VMware Directory Service (CVE-2026-59309) and a directory traversal in the Syslog server that can lead to code execution (CVE-2026-59310). The advisory did not report exploitation; days later researchers reported attacks exploiting CVE-2026-59310, and Broadcom updated the advisory in August with patches for version 7.0.
Why it matters
vCenter manages the virtual infrastructure: if it is compromised, an attacker can reach many systems from a single control point. The directory traversal requires prior access to the Syslog server, but that requirement does not reduce the impact once inside.
What we recommend
Apply the Broadcom patches for your version; allow access to vCenter only from the management network; and review access and accounts created since late July.
Related service: Infrastructure and Cloud
Want to know how it affects you?
We review your environment and tell you what to prioritise, with no commitment.