Skip to content
Sign in

Broadcom product

VMware vCenter

Alert
No CISA KEV deadline is open. CISA last added a VMware vCenter CVE on 18 Aug.

Tracked since 29 Jul · latest article 5 Sep · RSS · API

0Open KEV deadlines

None open

1Added to KEV · 90 days

of 1 in the full CISA catalogue · all time

0High exploit odds · current

EPSS top 5%, not in KEV

0Articles · 7 days

none this week

Exploited, by due date1

VMware vCenter CVEs in CISA KEV with their federal deadlines. None is open.

Exploited VMware vCenter CVEs
CVEProductAddedFederal deadlineArticles
In CISA KEVCVE-2026-59310RansomwareVMware vCenter18 AugPassed 21 Aug11
Vendor CSV of 5 entries for BroadcomAll 5 vendor entries, including other products.

Patch cadence and exploit odds

How often CISA adds VMware vCenter CVEs, how many have a fix, and where their exploit odds sit.

Added to CISA KEV per quarter

0Q1 ’250Q2 ’250Q3 ’250Q4 ’250Q1 ’260Q2 ’261Q3 ’260Q4 ’26
Show as table
Added to CISA KEV per quarter
QuarterAdded
Q1 20250
Q2 20250
Q3 20250
Q4 20250
Q1 20260
Q2 20260
Q3 20261
Q4 20260

Fix listed

1 of 1 CVE in coverage

Every CVE in coverage has a fix recorded.

EPSS percentile of each CVE

One dot per CVE; a red diamond marks those in CISA KEV.

top 5%CVE-2026-59310: 85th percentile, in CISA KEV050100
Show as table
FIRST EPSS percentiles across CVEs in coverage
CVEEPSS percentile
CVE-2026-5931085

Coverage11 articles · all time

The latest 11 articles naming VMware vCenter, in the shared story grammar.

Full timeline
Quiet for 7 weekslast report 5 Sep11 articles7 outlets

11 articles from 7 outlets since 29 Jul. Quiet since 5 Sep.

Now29 Jul471013161922263025First reportSecurityWeek · 29 Jul, 11:51CISA alert18 Aug, 19:42 · official
  • Wed 29 Jul, 11:51 UTC. SecurityWeek, first report. Broadcom Warns of VMware Flaws Allowing Host Code Execution.
  • Wed 29 Jul, 14:07 UTC. Security Affairs, its first report on the story. Broadcom patches critical VMware flaws, including admin VM escape.
  • Thu 30 Jul, 13:01 UTC. Rapid7, its first report on the story. Patch now: critical VMware vCenter remote code flaws.
  • Thu 13 Aug, 09:21 UTC. SecurityWeek. VMware vCenter CVE-2026-59310 flaw lets APT groups run code. Cites a CVE in CISA KEV.
  • Thu 13 Aug, 14:31 UTC. Infosecurity, its first report on the story. VMware vCenter CVE-2026-59310 flaw exploited worldwide within days. Cites a CVE in CISA KEV.
  • Tue 18 Aug, 19:42 UTC. CISA, its first report on the story. CISA Adds Critical VMware vCenter Flaw CVE-2026-59310 to KEV. Cites a CVE in CISA KEV.
  • Wed 19 Aug, 00:03 UTC. CISA. CISA flags VMware vCenter path traversal bug in KEV catalog.. Cites a CVE in CISA KEV.
  • Wed 19 Aug, 05:02 UTC. SecurityOnline, its first report on the story. CISA KEV Adds Four Exploited Flaws in SharePoint, vCenter. Cites a CVE in CISA KEV.
  • Wed 19 Aug, 08:01 UTC. Security Affairs. U.S. CISA adds Apple macOS, Microsoft SharePoint, Broadcom VMware vCenter, and Microsoft IKE flaws to its Known Exploited Vulnerabilities catalog. Cites a CVE in CISA KEV.
  • Wed 19 Aug, 14:02 UTC. SecurityOnline. Telegram seeks .gram domain as critical zero day exploits surge. Cites a CVE in CISA KEV.
  • Sat 5 Sep, 17:01 UTC. The Hacker News, its first report on the story. Broadcom Patches Critical VMware Flaws Enabling VM-to-Host Code Execution.
  • Known exploited CVE
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 11 articles as a list
  1. Wed 29 JulDay 02
    1. Broadcom Warns of VMware Flaws Allowing Host Code Execution11:51 · SecurityWeek · First report
    2. Broadcom patches critical VMware flaws, including admin VM escape14:07 · Security Affairs
  2. Thu 30 JulDay 11
    1. Patch now: critical VMware vCenter remote code flaws13:01 · Rapid7

  3. Quiet for 2 weeks

    Thu 13 AugDay 152
    1. VMware vCenter CVE-2026-59310 flaw lets APT groups run code09:21 · SecurityWeek · Exploited CVE · Picked up again · Known exploited CVE
    2. VMware vCenter CVE-2026-59310 flaw exploited worldwide within days14:31 · Infosecurity · Known exploited CVE

  4. Quiet for 5 days

    Tue 18 AugDay 201
    1. CISA Adds Critical VMware vCenter Flaw CVE-2026-59310 to KEV19:42 · CISA · official · CISA alert · Picked up again · Known exploited CVE
  5. Wed 19 AugDay 214
    1. CISA flags VMware vCenter path traversal bug in KEV catalog.00:03 · CISA · official · Known exploited CVE
    2. CISA KEV Adds Four Exploited Flaws in SharePoint, vCenter05:02 · SecurityOnline · Known exploited CVE
    3. U.S. CISA adds Apple macOS, Microsoft SharePoint, Broadcom VMware vCenter, and Microsoft IKE flaws to its Known Exploited Vulnerabilities catalog08:01 · Security Affairs · Known exploited CVE
    4. Telegram seeks .gram domain as critical zero day exploits surge14:02 · SecurityOnline · Known exploited CVE

  6. Quiet for 2 weeks

    Sat 5 SepDay 381
    1. Broadcom Patches Critical VMware Flaws Enabling VM-to-Host Code Execution17:01 · The Hacker News · Picked up again

All CVEs in coverage1

Exploited first, then by EPSS

In the CVE tracker
  • CVE-2026-59310Exploited

    Broadcom VMware vCenter Path Traversal Vulnerability

    9.8Critical2.6% EPSS · 11 articles
CyberSIXTSignal over noise
Updated AboutDevelopersSign in