CVE-2026-59310

Опубликовано: 30 июл. 2026

Источник: nvd

CVSS3: 9.8

EPSS Средний

Описание

VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.

Ссылки

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017
Vendor Advisory
https://medium.com/@quirso_de/active-exploitation-of-cve-2026-59310-361-victim-ips-across-47-countries-9783187cc6ff
Third Party Advisory
https://medium.com/@quirso_de/global-exploitation-of-cve-2026-59310-by-suspected-chinese-nexus-apt-related-cve-2026-59309-443a79e1466d
Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-59310
US Government Resource

Уязвимые конфигурации

Конфигурация 1

Одновременно

Одно из

cpe:2.3:a:vmware:vcenter_server:*:*:*:*:*:*:*:*

Версия до 8.0 (исключая)

cpe:2.3:a:vmware:vcenter_server:8.0:-:*:*:*:*:*:*

cpe:2.3:a:vmware:vcenter_server:8.0:a:*:*:*:*:*:*

cpe:2.3:a:vmware:vcenter_server:8.0:b:*:*:*:*:*:*

cpe:2.3:a:vmware:vcenter_server:8.0:c:*:*:*:*:*:*

cpe:2.3:a:vmware:vcenter_server:8.0:update1:*:*:*:*:*:*

cpe:2.3:a:vmware:vcenter_server:8.0:update1a:*:*:*:*:*:*

cpe:2.3:a:vmware:vcenter_server:8.0:update1b:*:*:*:*:*:*

cpe:2.3:a:vmware:vcenter_server:8.0:update1c:*:*:*:*:*:*

cpe:2.3:a:vmware:vcenter_server:8.0:update1d:*:*:*:*:*:*

cpe:2.3:a:vmware:vcenter_server:8.0:update1e:*:*:*:*:*:*

cpe:2.3:a:vmware:vcenter_server:8.0:update2:*:*:*:*:*:*

cpe:2.3:a:vmware:vcenter_server:8.0:update2a:*:*:*:*:*:*

cpe:2.3:a:vmware:vcenter_server:8.0:update2b:*:*:*:*:*:*

cpe:2.3:a:vmware:vcenter_server:8.0:update2c:*:*:*:*:*:*

cpe:2.3:a:vmware:vcenter_server:8.0:update2d:*:*:*:*:*:*

cpe:2.3:a:vmware:vcenter_server:8.0:update2e:*:*:*:*:*:*

cpe:2.3:a:vmware:vcenter_server:8.0:update3:*:*:*:*:*:*

cpe:2.3:a:vmware:vcenter_server:8.0:update3a:*:*:*:*:*:*

cpe:2.3:a:vmware:vcenter_server:8.0:update3b:*:*:*:*:*:*

cpe:2.3:a:vmware:vcenter_server:8.0:update3c:*:*:*:*:*:*

cpe:2.3:a:vmware:vcenter_server:8.0:update3d:*:*:*:*:*:*

cpe:2.3:a:vmware:vcenter_server:8.0:update3e:*:*:*:*:*:*

cpe:2.3:a:vmware:vcenter_server:8.0:update3g:*:*:*:*:*:*

cpe:2.3:a:vmware:vcenter_server:8.0:update3h:*:*:*:*:*:*

cpe:2.3:a:vmware:vcenter_server:8.0:update3i:*:*:*:*:*:*

cpe:2.3:a:vmware:vcenter_server:8.0:update3j:*:*:*:*:*:*

Одно из

cpe:2.3:a:vmware:telco_cloud_infrastructure:3.0:*:*:*:*:*:*:*

cpe:2.3:a:vmware:telco_cloud_platform:*:*:*:*:*:*:*:*

Версия от 3.0 (включая) до 5.2 (включая)

Конфигурация 2

Одновременно

Одно из

cpe:2.3:a:vmware:vcenter_server:*:*:*:*:*:*:*:*

Версия от 9.0 (включая) до 9.0.2.0100 (исключая)

cpe:2.3:a:vmware:vcenter_server:*:*:*:*:*:*:*:*

Версия от 9.1 (включая) до 9.1.0.0300 (исключая)

Одно из

cpe:2.3:a:vmware:cloud_foundation:-:*:*:*:*:*:*:*

cpe:2.3:a:vmware:vsphere_foundation:-:*:*:*:*:*:*:*

EPSS

Процентиль: 99%

0.45878

Средний

9.8 Critical

CVSS3

Дефекты

CWE-22

Связанные уязвимости

GHSA-v2gp-49gj-2c9f

CVSS3: 9.8

github

28 дней назад

VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.

BDU:2026-11333

CVSS3: 9.8

fstec

30 дней назад

Уязвимость сервера Syslog Server средства управления виртуальной инфраструктурой VMware vCenter Server, позволяющая нарушителю выполнить произвольный код

EPSS

Процентиль: 99%

0.45878

Средний

9.8 Critical

CVSS3

Дефекты

CWE-22