Broadcom · VMware vCenter
CVE-2026-59310
vCenter directory-traversal vulnerability
O que é
VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.
CISA: Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code.
O que fazer
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Prazo para as agências federais dos EUA: 21 de agosto de 2026
Mais falhas exploradas de Broadcom
| Adicionado | Vulnerabilidade | Produto | Gravidade | Chance de ataque |
|---|---|---|---|---|
| 3 de mar. de 2026 | Command Injection | VMware Aria Operations | Alto 8,1 | 18% |
| 23 de jan. de 2026 | Out-of-bounds Write | VMware vCenter Server | Crítica 9,8 | 22% |
| 30 de out. de 2025 | Privilege Defined with Unsafe Actions | VMware Aria Operations and VMware Tools | Alto 7,8 | 8,6% |
| 28 de abr. de 2025 | Code Injection | Brocade Fabric OS | Alto 8,6 | 0,7% |
Fontes: Known Exploited Vulnerabilities (CISA, domínio público), CVE records (cve.org) e EPSS (FIRST). A chance de ataque é a estimativa EPSS de que alguém tente explorar a falha nos próximos 30 dias.