VMware CVE-2026-59309: Critical vCenter Auth Bypass Chains Into VM Escape

VMware CVE-2026-59309 is a CVSS 9.8 authentication-bypass flaw in vCenter Server that lets an unauthenticated attacker take over the management plane of a vSphere estate, and Broadcom disclosed it alongside CVE-2026-59310 (a 9.8 directory-traversal RCE) and CVE-2026-47876 (a 9.3 VMXNET3 virtual-machine escape) in advisory VMSA-2026-0006. There are no workarounds; patching is the only fix. Updated August 19, 2026: CISA added CVE-2026-59310, the directory-traversal RCE disclosed alongside this auth bypass in VMSA-2026-0006, to its Known Exploited Vulnerabilities catalog on August 18, 2026, confirming active exploitation of the chain. Patch as an emergency. Together the three bugs give an attacker a path from a single guest VM all the way to full infrastructure compromise, which is why defenders are treating this as an emergency-maintenance event rather than a routine patch cycle.

The auth-bypass (CVE-2026-59309, CWE-303) and the path-traversal RCE (CVE-2026-59310, CWE-22) both sit in vCenter and are network-reachable with no credentials, so an attacker who can see a vCenter's management ports can authenticate as no one and execute code as the platform. The third flaw, CVE-2026-47876 (CWE-787, an out-of-bounds write in the VMXNET3 virtual network adapter), works from the other direction: code running inside a guest VM can break out to the ESXi host. Stacked together, a foothold in one tenant VM becomes host execution, and unauthenticated vCenter takeover becomes control of every host it manages. Broadcom credited its own researchers and reported no evidence of exploitation at disclosure. That window has since closed: CISA added CVE-2026-59310, the directory-traversal RCE in this chain, to its Known Exploited Vulnerabilities catalog on August 18, 2026 (CVE-2026-59309 itself is not yet KEV-listed).

Which VMware products and versions are affected?

The flaws span vCenter Server, ESXi, VMware Workstation and Fusion, and the packaged stacks, VMware Cloud Foundation, vSphere Foundation, and Telco Cloud, that bundle them. Broadcom has stated there are no mitigations or workarounds, so the fixed builds below are mandatory.

Is there a public exploit or PoC for CVE-2026-59309?

Because the community read is that weaponization is a matter of days, not months. Reverse engineers on Hacker News and infosec Twitter note that an authentication bypass in the directory service and a path traversal in the syslog handler are exactly the kind of bugs that are easy to diff from the patch and turn into a working exploit, and researchers expect mass Shodan and Censys scanning for exposed vCenter ports (443, 389, 636, 2012) followed by public PoCs. On r/sysadmin the friction is operational rather than technical: teams report trouble pulling patch binaries for legacy or license-limited deployments through Broadcom's portal, which slows the exact emergency patching this situation demands. The most-asked practical questions are the patching order (patch vCenter before ESXi hosts) and what vmdir or syslog log entries would reveal a bypass attempt.

Our read

VMware infrastructure is the flat, high-value core that annual pentests routinely never reach, and it is a standing favorite of both ransomware crews and state actors. In our analysis of 2025's actively exploited vulnerabilities, 67% would have been missed by a once-a-year pentest, and the disclosure-to-exploitation gap has a median of just 26 days; a chainable 9.8 in vCenter is precisely the profile that closes that gap fastest. Continuous verification means an exposed vCenter management port is caught and confirmed the day the advisory drops, not at the next scheduled test, by which time a public PoC is already scanning for you.

Reporting by BleepingComputer and Broadcom's VMSA-2026-0006 advisory; CVSS and CWE data per NVD. Sources linked above.

Related: Cisco FMC CVE-2026-20316: static-credential zero-day in KEV · What CVSS and EPSS miss for patch prioritization

Frequently asked questions

Is CVE-2026-59309 being exploited in the wild?
Not at disclosure, per Broadcom, but the chain is now under active attack. CISA added the companion directory-traversal RCE, CVE-2026-59310, to its Known Exploited Vulnerabilities catalog on August 18, 2026. CVE-2026-59309 itself is not yet KEV-listed, but the two were disclosed together and share the vCenter attack surface, so treat exposed vCenter as actively targeted, not pre-exploitation.

Is there a workaround if I can't patch immediately?
No. Broadcom explicitly states there are no workarounds or mitigations. The only remediation is upgrading to the fixed builds. If you cannot patch at once, restrict vCenter management interfaces to out-of-band networks and block ports 443/389/636/2012 from untrusted subnets as a stopgap.

What's the correct patching order?
Patch vCenter Server first (it manages the fleet), then the ESXi hosts, then Workstation/Fusion endpoints. Confirm your deployment train (8.0 U3k vs 9.0.2 vs 9.1) before applying builds.

Why is the VMXNET3 flaw so serious if it needs code in a guest VM?
Because it converts any single compromised or malicious VM into a foothold on the ESXi host, and from a host an attacker can pivot across the cluster. Chained with the vCenter bugs it removes the isolation boundary the whole virtualization model depends on.