DaystoPatch

Broadcom (VMware)Exploited incident

VMware vCenter Syslog server directory-traversal vulnerability (VMSA-2026-0006)

CVE-2026-59310Critical, CVSS 9.8In CISA's Known Exploited Vulnerabilities catalog since 18 Aug 2026

  • Exploited after a fix existed
  • Known ransomware use
FixedFixed for every supported version 5 days after the first public report.

Response

Silence
same day
First public report to first vendor statement
Exposure
same day
First public report to first fix
Follow-through
5d
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    date only

    Broadcom VMSA-2026-0006 (Wayback snapshot 2026-07-29 11:57 UTC)CuratedQuote verified

    2026-07-29 (Initial Advisory)

    The vendor advisory was the first public signal (privately reported by Atredis Partners). Exploitation began afterwards: QUIRSO saw compromised systems connecting to attacker infrastructure from 3 Aug 2026 (BleepingComputer, Aug 13 2026).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:a38a8bf2b571ed92…
    Used in metrics
    Yes
    Dispute this timestamp
    5 more sources for this moment
    Bluesky postClaimedQuote not checked yet29 Jul 2026, 10:28 UTC

    Broadcom released updates to fix a critical VMware authentication bypass (CVE-2026-59309). A directory traversal flaw (CVE-2026-59310) was also patched.

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet29 Jul 2026, 12:48 UTC

    Broadcom patched a critical VMware vCenter vulnerability. CVE-2026-59309 and CVE-2026-59310 both score 9.8 CVSS and allow auth bypass or code execution. # VMware # vCenter # CVE202659309 # CVE202659310 # ESXi # InfoSec https:// meterpreter.org/vmware-vcenter

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2026-59310ClaimedQuote verified30 Jul 2026, 12:19 UTC

    VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:f39de73f7eb775b3…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2026-59310)ClaimedQuote verified18 Aug 2026

    Broadcom VMware vCenter Path Traversal Vulnerability

    Added to CISA's KEV catalog on 2026-08-18.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Hacker NewsClaimedQuote not checked yet6 Oct 2026, 10:00 UTC

    https://mobeta.fr/blog/vcenter-cve-2026-59309-cve-2026-59310/

    Earliest third-party post we hold.

    Source
    Hacker News hn
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    date onlysame day

    Broadcom VMSA-2026-0006 (notification 38017, Wayback snapshot 2026-09-30)CuratedQuote verified

    29 July 2026

    'Initial Publication Date' field. The live support.broadcom.com page returns a Cloudflare challenge to non-browser clients, so a Wayback snapshot is cited. The earliest Wayback capture is 2026-07-29 11:57:16 UTC.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:518ea3e41eaabecb…
    Used in metrics
    Yes
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    date onlysame day

    Broadcom VMSA-2026-0006 (Wayback snapshot 2026-07-29 11:57 UTC)CuratedQuote verified

    Updates are available to remediate these vulnerabilities in affected Broadcom products.

    Initial advisory (issue date 2026-07-29) already listed fixed vCenter versions 9.1.x, 9.0.2.0100 and 8.0 U3k.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:a38a8bf2b571ed92…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    date only+5d

    Broadcom VMSA-2026-0006.1 change log (Wayback snapshot 2026-09-30)CuratedQuote verified

    ESX 8.0 U2f and vCenter 8.0 U2f express patches are available.

    Change log entry headed '2026-08-03 VMSA-2026-0006.1'. The 8.0 U2 line was the last generally supported branch to get a fix. A further revision '2026-08-19 VMSA-2026-0006.2' 'Added ESX/vCenter 7.0 patch guidance for Critical severity issues' (vCenter 7.0: 'Contact Broadcom Support if you have extended support contract.'); 7.0 is past general support, so it is not counted for patch_all.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:518ea3e41eaabecb…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • VMware vCenter Server
  • VMware Cloud Foundation
  • VMware vSphere Foundation
  • VMware Telco Cloud Platform
  • VMware Telco Cloud Infrastructure
How we built this timeline

Coordinated disclosure, exploited after the fix. VMSA-2026-0006 also covers CVE-2026-59309 (vCenter authentication bypass, same fixed versions; not in KEV as of 21 Oct 2026), CVE-2026-47876, CVE-2026-41703 and CVE-2026-41709.

Exploitation: QUIRSO reported a campaign deploying reverse_ssh from 3 Aug 2026 across 361 victim IPs (BleepingComputer, 'August 13, 2026 12:40 PM', https://www.bleepingcomputer.com/news/security/critical-vmware-vcenter-rce-flaw-exploited-for-reverse-ssh-access/), and later linked one intrusion to Babuk-derived ransomware (The Hacker News, Aug 17, 2026, https://thehackernews.com/2026/08/suspected-china-nexus-actor-exploits.html). As of the latest Wayback snapshot (30 Sep 2026) the VMSA itself carries no exploitation statement.

Status 'patched' assumes vSphere 7.0 (extended support only) is out of scope.

Related

Broadcom (VMware) report card