Critical Path Traversal Vulnerability in VMware vCenter Server

• •CVE-2026-59310 allows remote code execution via path traversal in VMware vCenter Server.
• •Exploitation requires only access to the syslog port; no credentials are needed.
• •Active exploitation has been confirmed, and patches are available for affected versions.

A critical vulnerability, CVE-2026-59310, has been identified in VMware vCenter Server that allows for unauthorized remote code execution through a path traversal exploit. This flaw affects versions prior to 9.0.2.0 / Build 25148086, where attackers can exploit the syslog service by sending specially crafted messages to the syslog port (UDP/TCP 514) without requiring credentials. The vulnerability arises from the use of dynamic path templates that concatenate untrusted fields, enabling attackers to write arbitrary files and execute code with root privileges. The exploit has been publicly documented, with proof-of-concept code available since August 17, 2026. As of August 18, 2026, this vulnerability has been added to the CISA KEV catalog due to active exploitation in the wild. Organizations using affected versions are urged to apply patches immediately to mitigate potential attacks.