[HIGH PRIORITY] VMware vCenter Syslog Path Traversal RCE (CVE-2026-59310)

⚠ HIGH PRIORITY — CISA KEV (Aug 2026). CVE-2026-59310 is a path traversal flaw in VMware vCenter's Syslog server. Any attacker with network access to vCenter can achieve remote code execution on the appliance — full control of your virtualization management plane.

Affected vCenter

• VMware vCenter Server builds listed in Broadcom VMSA-2026-0008
• vCenter with Syslog forwarding enabled (default in many deployments)
• Management VLAN reachable from compromised workstation or flat network

Check version

ssh admin@vcenter.local
vpxd -v 2>/dev/null || cat /etc/vmware-vpx/version
ss -tlnp | grep 514

Patching Method

1. Download fixed vCenter ISO/patch from Broadcom Customer Connect.
2. Snapshot vCenter VM or take appliance backup before upgrade.
3. Apply patch via VAMI (https://vcenter:5480) → Update → Install.
4. Reboot vCenter; confirm Syslog service starts cleanly.
5. Verify build matches VMSA fixed-version table.
6. Review Syslog and vpxd logs for traversal attempts in last 30 days.
7. Rotate vCenter SSO and local admin passwords post-patch.

grep -i syslog /var/log/vmware/vpxd.log | tail -50
grep -i traversal /var/log/vmware/syslog.log 2>/dev/null

Until patched

• Restrict vCenter management (443, 5480) to jump-host IP allowlist
• Segment vCenter on dedicated management VLAN — no internet exposure
• Assume compromise if vCenter was internet-facing and unpatched

CVSS: 9.8 Critical. No vendor workaround — patch only.