CISA has added CVE‑2026‑59310 to its Known Exploited Vulnerabilities catalogue, affecting Broadcom’s VMware vCenter product. The vulnerability, named the Broadcom VMware vCenter Path Traversal Vulnerability, allows an attacker with network access to vCenter to execute arbitrary code via a path traversal flaw.
The flaw is a critical path traversal issue that can be exploited remotely without authentication, leading to arbitrary code execution on the underlying system. It carries a CVSS v3.1 base score of 9.8, rated Critical, and a security patch is available from Broadcom.
Active exploitation has been confirmed, which is the basis for its inclusion in the KEV catalogue; there is no public indication of ransomware use at this time. CISA has set a remediation deadline of 26 August 2026 for federal agencies to address the vulnerability.
CISA’s required action is to apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26‑04 Prioritising Security Updates Based on Risk guidance and CISA’s Forensics Triage Requirements. For cloud services, follow the applicable BOD 26‑04 guidance or discontinue use if mitigations cannot be applied. Stakeholders must evaluate each asset’s internet exposure and adhere to BOD 26‑04 patching guidelines.
While the directive binds Federal Civilian Executive Branch agencies, all organisations should review their exposure and apply the available patch promptly.
For full details, consult the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-59310 and the CISA KEV catalogue.