by Kastro
Paper/Archive/CVE-2026-59309

CVE-2026-59309

VMware Cloud Foundation — vCenter authentication-bypass vulnerability

EPSS 0.6%CVSS 9.8
critical.is priorityof 100
39
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 49.3.493 × 209.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized access to the system.

Affected

ProductAffectedFixed inSource
Cloud Foundation9.1.x.x–CNA
Cloud Foundation9.0.x.x–CNA
Cloud Foundation5.x–CNA
vSphere Foundation9.1.x.x–CNA
vSphere Foundation9.0.x.x–CNA
vCenter9.1.x.x – < 9.1.0.03009.1.0.0300CNA
vCenter9.0.x.x – < 9.0.2.01009.0.2.0100CNA
vCenter8.0 – < 8.0 U3k8.0 U3kCNA
Telco Cloud Infrastructure3.0–CNA
Telco Cloud Platform5.1.x–CNA
Telco Cloud Platform5.0.x–CNA
Telco Cloud Platform4.x–CNA

Scores by source

vmware (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refsupport.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017