VMware vCenter Pre‑Auth RCE: CVE‑2026‑59309 & CVE‑2026‑59310 Exposed
What are CVE‑2026‑59309 and CVE‑2026‑59310 and why do they matter?
VMware vCenter 9.8 contains two pre‑authentication remote‑code‑execution bugs—CVE‑2026‑59309, an authentication bypass, and CVE‑2026‑59310, a syslog path‑traversal that leads to code execution—affecting any unpatched instance and giving attackers full control of the management plane, according to the disclosure discussed by researchers.
How can attackers exploit these pre‑auth flaws?
Both vulnerabilities are exploitable without valid credentials. CVE‑2026‑59309 tricks the login routine into accepting crafted requests, granting unauthenticated access to the vCenter UI. CVE‑2026‑59310 abuses a syslog configuration field, allowing an attacker to write a malicious file to an arbitrary location and then trigger its execution via the vCenter service.
Because the bugs are pre‑authentication, automated scanners can locate vulnerable hosts quickly, and threat actors can chain the bypass with the path‑traversal to achieve a full remote code execution chain.
Who is most at risk from the vCenter vulnerabilities?
Enterprises that run VMware vCenter Server 9.8 in production, especially those that expose the management interface to internal networks or the internet, are directly in scope. Managed service providers hosting multiple customer vCenters amplify the attack surface, as a single compromised instance can serve as a foothold to pivot across tenant environments.
Organizations that rely on legacy monitoring tools or custom scripts that interact with vCenter syslog may inadvertently broaden the exposure if they allow untrusted input.
What immediate actions should organizations take?
First, apply VMware’s official patches for CVE‑2026‑59309 and CVE‑2026‑59310, which address the authentication logic and sanitize the syslog path. If patching cannot be completed within the maintenance window, temporarily block inbound traffic to the vCenter management ports (TCP 443 and 902) at the perimeter and enforce strict network segmentation.
Second, run an authenticated or unauthenticated vulnerability scan focused on vCenter endpoints. GetKhojo’s attack‑surface scanner can enumerate exposed services, verify patch levels, and flag misconfigured syslog destinations.
Third, audit syslog configurations and remove any write‑able directories that are not essential. Restrict the vCenter service account to the least privileges required for normal operation, aligning with privacy‑hygiene best practices.
How does this incident illustrate broader attack‑surface awareness?
Pre‑auth bugs highlight that the attack surface extends beyond the data plane; management interfaces are high‑value targets. Regularly mapping all exposed APIs, ports, and configuration files helps security teams spot low‑hanging fruit before attackers do.
GetKhojo recommends a quarterly “attack‑surface review” that combines passive network discovery with active patch‑diffing, similar to how researchers identified these vCenter flaws by comparing patched and unpatched binaries.
What does this mean for you?
If your organization runs VMware vCenter, treat these CVEs as critical. Patch now, lock down network access, and verify that your monitoring pipelines do not unintentionally expose writable paths. A disciplined attack‑surface management program will reduce the chance that a future pre‑auth flaw slips through unnoticed.
Frequently asked questions
Can I detect CVE‑2026‑59309 with a standard vulnerability scanner?
Yes, most enterprise scanners now include signatures for CVE‑2026‑59309 and will flag unpatched vCenter instances during credential‑less scans of port 443.
Is it safe to disable syslog on vCenter to mitigate CVE‑2026‑59310?
Disabling syslog removes the immediate path‑traversal vector, but it also eliminates important audit data; a better approach is to restrict the syslog directory and apply the vendor patch.
How often should I review my vCenter attack surface?
A quarterly review is recommended, combining network enumeration, configuration audits, and patch‑diffing to catch both known CVEs and emerging misconfigurations.
