CVE-2026-59310: Broadcom VMware vCenter Path Traversal Vulnerability Allows Remote Code Execution
What It Is – Broadcom’s VMware vCenter Server contains a path‑traversal flaw (CVE‑2026‑59310) that can be abused by an adversary who has network access to the vCenter management interface to read arbitrary files and execute code on the underlying host.
Exploitability – The vulnerability is publicly disclosed and assigned a CVSS v3.1 base score of 9.8 (Critical). No public exploit code has been observed, but the attack requires only network‑level reachability to the vCenter console.
Affected Products – VMware vCenter Server (Broadcom‑branded releases) versions prior to the vendor‑issued patch (specific versions listed in the Broadcom advisory).
Why It Matters for Trust & Control Assurance
- Control Mapping: The flaw tests the effectiveness of your “secure configuration management” control – a single control that maps to many frameworks (e.g., NIST CSF, ISO 27001, SOC 2).
- Continuous Monitoring: Detecting unpatched vCenter instances and evidencing remediation are essential for a defensible audit trail.
- Audit Readiness: Demonstrating timely patch application and restricted network exposure satisfies auditors looking for evidence of risk‑based change management.
Recommended Actions
- Inventory every vCenter deployment and confirm the exact version.
- Apply Broadcom’s security update immediately, or isolate the vCenter management interface from untrusted networks as a temporary mitigation.
- Update your configuration‑management control documentation and capture patch‑installation logs as evidence.
- Enable logging of vCenter admin console access and monitor for anomalous file‑access patterns.
Source: CISA KEV – CVE‑2026‑59310