Critical severity · published Jul 30, 2026
CVE-2026-59309
vCenter authentication-bypass vulnerability
9.8
CVSS
0.6%
EPSS
No
On KEV
Description
VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized access to the system.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VS
vCenter Server · VMware
9.1.x.x before 9.1.0.0300; 9.0.x.x before 9.0.2.0100; 8.0 before 8.0 U3k · source: vendor, NVD
CF
Cloud Foundation · VMware
9.1.x.x; 9.0.x.x; 5.x · source: vendor
TC
Telco Cloud Infrastructure · VMware
3.0 · source: vendor
TC
Telco Cloud Platform · VMware
5.1.x; 5.0.x; 4.x; 3.0 · source: vendor
VF
vSphere Foundation · VMware
9.1.x.x; 9.0.x.x · source: vendor
In the news
VulnerabilityCritical
Three Critical VMware Flaws Allow Auth Bypass, Code Execution, and VM Escape
Broadcom has released security updates to address multiple security flaws impacting VMware ESX, vCenter, Workstation, and Fusion, three of which have been designated as critical in severity.
The first of the three critical-rated flaws is CVE-2026-59309 (CVSS score: 9.8), which has been described as an authentication bypass in VMware vCenter.
"A malicious actor with network access to vCenter
Jul 29, 2026·The Hacker News
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-59309
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-59309
Vendor Advisory
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017
More from vCenter Server
9.8
CVE-2026-59310
vCenter directory-traversal vulnerability
9.8
CVE-2024-38813
Privilege escalation vulnerability
9.8
CVE-2024-38812
Heap-overflow vulnerability
9.8
CVE-2024-37079
Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability
9.8
CVE-2023-34048
VMware vCenter Server Out-of-Bounds Write Vulnerability