Threat reportVulnerabilityTL-2026-1764
Three Critical VMware Flaws (CVE-2026-59309, CVE-2026-59310, CVE-2026-47876) Allow Auth Bypass, RCE, and VM Escape
Three Critical VMware Flaws (CVE-2026-59309, CVE-2026-59310 (TL-2026-1764), also tracked as VMSA-2026-0006, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-07-29 and last reviewed 2026-08-14. It has no confirmed attribution, affects Broadcom/VMware vCenter Server, references 5 CVEs (CVE-2026-59309, CVE-2026-59310, CVE-2026-47876), maps to 37 MITRE ATT&CK techniques (T1005, T1021, T1027), and is covered by 9 detection rules and 56 indicators of compromise.
- CVSS
- 9.8/10Critical
- CVEs
- 5Referenced vulnerabilities
- Techniques
- 37MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 56Indicators of compromise
Key facts for TL-2026-1764
- Threat ID
- TL-2026-1764
- Also known as
- VMSA-2026-0006
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- telecoms, government administration, finance, health, technology, cloud-hosting
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 56
- Updates
- 2026-08-14 · 7 updates · revalidated 7× · latest source
How Three Critical VMware Flaws (CVE-2026-59309, CVE-2026-59310 works
Broadcom's VMSA-2026-0006 patches an unauthenticated authentication bypass in the vCenter VMware Directory Service (CVE-2026-59309, CVSS 9.8), a directory-traversal flaw in the vCenter Syslog server enabling arbitrary code execution (CVE-2026-59310, CVSS 9.8), and an out-of-bounds write in the VMXNET3 virtual network adapter allowing guest-to-host VM escape (CVE-2026-47876, CVSS 9.3). Broadcom states no evidence of in-the-wild exploitation or public PoC for any of the three.
On 2026-07-29 Broadcom published VMSA-2026-0006, a security advisory covering five vulnerabilities across the VMware virtualization portfolio (vCenter Server, ESX/ESXi, Cloud Foundation, vSphere Foundation, Workstation, Fusion, Telco Cloud Platform, and Telco Cloud Infrastructure). Three of the five are rated CRITICAL and are the focus of this threat record.
CVE-2026-59309 (CVSS 9.8) is an authentication bypass in the VMware Directory Service (vmdird) that underpins vCenter Single Sign-On. A network-based attacker with no prior credentials can send crafted requests to the Directory Service and fully bypass authentication, gaining unauthorized administrative access to the vCenter management plane — and, transitively, to every ESXi host, VM, and workload vCenter governs. Broadcom credits Phil Brass and Matt South of Atredis Partners for the discovery.
CVE-2026-59310 (CVSS 9.8) is a directory-traversal vulnerability in the vCenter Syslog server. A network-based, unauthenticated attacker can traverse the filesystem to read or write files outside the intended logging directory, which escalates to arbitrary code execution on the vCenter appliance (a Linux/Photon-OS-based virtual appliance). Security reporting describes a compromised vCenter as a potential "beachhead for lateral movement" into the rest of the virtual infrastructure.
CVE-2026-47876 (CVSS 9.3) is an out-of-bounds write in the VMXNET3 paravirtualized network adapter used by ESX/ESXi guest VMs. An attacker who has already obtained local administrator privileges inside a guest VM configured with a VMXNET3 adapter can trigger the OOB write to execute code on the underlying ESX host — a classic guest-to-host VM escape. VMs using other adapter types (e.g., E1000/E1000E) are not affected by this specific flaw.
Broadcom's advisory also lists two lower-severity companion issues in the same disclosure batch — CVE-2026-41703 (CVSS 7.6, out-of-bounds read / information disclosure or DoS in ESX, Workstation, and Fusion) and CVE-2026-41709 (CVSS 2.7, insufficient logging in ESX) — which are noted here for advisory-cluster context but are not part of this threat's tracked CVE set.
No workaround exists for either critical vCenter issue (CVE-2026-59309, CVE-2026-59310); patching to the fixed builds is the only remediation Broadcom documents. No workaround is documented for CVE-2026-47876 either. Broadcom states it has no information indicating any of the three critical CVEs have been exploited in the wild, and no public proof-of-concept exploit code has surfaced as of this writing; the vulnerabilities were privately reported by external researchers and credited in the advisory (Phil Brass and Matt South of Atredis Partners; Nguyen Hoang Thach of STARLabs SG, associated with Pwn2Own; Maxim Suhanov; and Ian Barton of CrowdStrike).
Given the severity (two unauthenticated, network-exploitable 9.8s on the vCenter management plane, plus a 9.3 hypervisor-escape bug), unpatched vCenter/ESXi environments represent an attractive target: successful chaining of CVE-2026-59309 → CVE-2026-59310 would give a remote, unauthenticated attacker full code execution on the vCenter appliance without ever needing valid credentials, and CVE-2026-47876 gives any VM-level attacker with local admin a path out of the guest sandbox onto the physical host.
MITRE ATT&CK techniques used in TL-2026-1764
Collection
Lateral Movement
T1021 Remote Services; T1210 Exploitation of Remote Services
Defense Evasion
T1027 Obfuscated Files or Information; T1027.002 Obfuscated Files or Information: Software Packing
Persistence
T1053.003 Scheduled Task/Job: Cron; T1136 Create Account; T1505.003 Web Shell
Execution
T1059 Command and Scripting Interpreter; T1059.004 Unix Shell
Privilege Escalation
T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism; T1611 Escape to Host
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1090 Proxy; T1105 Ingress Tool Transfer; T1219 Remote Access Software; T1571 Non-Standard Port; T1572 Protocol Tunneling
Discovery
T1082 System Information Discovery; T1083 File and Directory Discovery; T1518 Software Discovery; T1580 Cloud Infrastructure Discovery
Initial Access
T1190 Exploit Public-Facing Application
Credential Access
T1212 Exploitation for Credential Access; T1552.001 Credentials In Files; T1555 Credentials from Password Stores; T1556 Modify Authentication Process
Impact
T1499.001 OS Exhaustion Flood; T1499.004 Application or System Exploitation
Resource Development
T1587 Develop Capabilities; T1588.002 Obtain Capabilities: Tool; T1588.005 Exploits; T1588.006 Vulnerabilities
Reconnaissance
T1595.002 Vulnerability Scanning
defense-impairment
T1685 Disable or Modify Tools; T1685.006 Clear Linux or Mac System Logs
Affected products and versions in Three Critical VMware Flaws (CVE-2026-59309, CVE-2026-59310
- Broadcom/VMware — vCenter Server
Vulnerable versions: 8.0; 9.0.x.x; 9.1.x.x
Fixed in: 8.0 U3k; 9.0.2.0100; 9.1.0.0300 - Broadcom/VMware — ESX / ESXi
Vulnerable versions: 8.0; 9.0.x.x; 9.1.x.x
Fixed in: ESXi80U3k-25595708; ESXi-9.0.2.0100-25595025; ESXi-9.1.0.0200-25557999 - Broadcom/VMware — VMware Cloud Foundation
Vulnerable versions: 5.x; 9.0.x.x; 9.1.x.x
Fixed in: 8.0 U3k (async); 9.0.2.0100; 9.1.0.0300 - Broadcom/VMware — VMware vSphere Foundation
Vulnerable versions: 9.0.x.x; 9.1.x.x
Fixed in: 9.0.2.0100; 9.1.0.0300 - Broadcom/VMware — VMware Workstation
Vulnerable versions: 25H2
Fixed in: See VMSA-2026-0006 patch matrix (companion CVE-2026-41703) - Broadcom/VMware — VMware Fusion
Vulnerable versions: 25H2
Fixed in: See VMSA-2026-0006 patch matrix (companion CVE-2026-41703) - Broadcom/VMware — VMware Telco Cloud Platform / Telco Cloud Infrastructure
Vulnerable versions: Affected releases per Telco Cloud response guidance
Fixed in: See VMware Telco Cloud response to VMSA-2026-0006
Remediation for Three Critical VMware Flaws (CVE-2026-59309, CVE-2026-59310
Patches
- vCenter Server 9.1.0.0300
- vCenter Server 9.0.2.0100
- vCenter Server 8.0 U3k
- ESXi-9.1.0.0200-25557999
- ESXi-9.0.2.0100-25595025
- ESXi80U3k-25595708
- VMware Cloud Foundation 9.1.0.0300
- VMware Cloud Foundation 9.0.2.0100
- VMware Cloud Foundation 5.x (async patch to 8.0 U3k)
Immediate actions
- Apply VMSA-2026-0006 patches immediately to all affected vCenter Server, ESX/ESXi, Cloud Foundation, and vSphere Foundation deployments — Broadcom documents no workaround for CVE-2026-59309 or CVE-2026-59310.
- Restrict network access to vCenter Server management interfaces (HTTPS management port, vmdir, and syslog service) to trusted management networks only pending patch deployment.
- Inventory all ESX/ESXi hosts and guest VMs using the VMXNET3 virtual network adapter and prioritize patching to the CVE-2026-47876 fixed builds.
- Audit and tighten local administrator privileges within guest VMs to reduce the CVE-2026-47876 guest-to-host escape attack surface pending patch.
Workarounds
- None documented — Broadcom states no workaround exists for CVE-2026-59309 or CVE-2026-59310; patching is the only remediation.
- No vendor workaround documented for CVE-2026-47876; restricting VMXNET3 use and guest local-admin access is a compensating control only, not a fix.
Longer-term hardening
- Segment vCenter/vSphere management-plane traffic from general enterprise and internet-facing networks.
- Route vCenter/ESXi logging to an external, centralized, tamper-resistant log collector to reduce the blast radius of syslog-service compromise.
- Establish a recurring VMSA advisory review and patch-cadence process given the frequency and severity of critical vCenter/ESXi disclosures.
- Apply least-privilege guest administration policies so fewer VM administrators are positioned to attempt a VMXNET3-based host escape.
CVEs associated with Three Critical VMware Flaws (CVE-2026-59309, CVE-2026-59310
CVE-2026-59309, CVE-2026-59310, CVE-2026-47876, CVE-2026-41703, CVE-2026-41709
Weaknesses (CWE) in Three Critical VMware Flaws (CVE-2026-59309, CVE-2026-59310
Timeline of Three Critical VMware Flaws (CVE-2026-59309, CVE-2026-59310
Showing the 20 most recent tracked events.
- SecurityWeek publishes technical analysis of the CVE-2026-47876 VMXNET3 VM-escape vulnerability.
- The Hacker News publishes "Three Critical VMware Flaws Allow Auth Bypass, Code Execution, and VM Escape," the primary public reporting on the advisory.
- VMware Telco Cloud publishes response guidance detailing VMSA-2026-0006 impact and remediation for Telco Cloud Platform and Telco Cloud Infrastructure customers.
- Broadcom states it has no information indicating in-the-wild exploitation of CVE-2026-59309, CVE-2026-59310, or CVE-2026-47876 as of the advisory's publication.
- Fixed builds released concurrently with disclosure: vCenter 9.1.0.0300 / 9.0.2.0100 / 8.0 U3k and ESXi-9.1.0.0200-25557999 / ESXi-9.0.2.0100-25595025 / ESXi80U3k-25595708.
- Broadcom publishes VMSA-2026-0006, disclosing CVE-2026-59309, CVE-2026-59310, CVE-2026-47876, CVE-2026-41703, and CVE-2026-41709 across the VMware virtualization portfolio.
- CVE-2026-59309 privately reported to Broadcom by Phil Brass and Matt South of Atredis Partners; credited in VMSA-2026-0006.
- Researchers covering VMSA-2026-0006 cite the China-nexus espionage group UNC3886's prior exploitation of vCenter/ESXi zero-day CVE-2023-34048 (active since late 2021, confirmed by Broadcom in January 2024) as historical precedent for rapid post-disclosure targeting of VMware management infrastructure — cited as pattern context, not attribution to this advisory's CVEs.
- NVD publishes formal CVE records for all five VMSA-2026-0006 vulnerabilities, one day after Broadcom's advisory, confirming CVSS vectors and CWE classifications for each.
- Qualys ThreatPROTECT publishes detection guidance and QIDs (388184, 216356, 216358) for scanning affected VMware ESX, vCenter, Workstation, and Fusion deployments for VMSA-2026-0006.
- Rapid7 published a technical breakdown of CVE-2026-59309 and CVE-2026-59310, noting vCenter Server's history of roughly ten prior CISA KEV listings for unrelated vulnerabilities.
- Community analysis (AngrySysOps) reported that installing vCenter Server 8.0 Update 3k temporarily blocks the direct in-place upgrade path to VCF 9.1, an operational sequencing consideration for administrators applying the patch.
- Independent researcher analysis (Penligent) modeled the generic six-stage attack chain for CVE-2026-59309 and confirmed Broadcom had not published a vulnerable port, endpoint, or any IOC/YARA/Sigma/Suricata signature, recommending SSO admin-group and permission-change monitoring as a compensating control.
- QUIRSO observes the first vCenter hosts beaconing outbound to attacker-controlled infrastructure — active exploitation of CVE-2026-59310 begins five calendar days after disclosure.
- 151 additional victim IPs identified as the campaign rapidly scales.
- Roughly 95% of the eventual victim total (343 of 361 IPs) observed connecting to attacker infrastructure.
- QUIRSO's tracked victim count reaches 361 unique IP addresses across 47 countries, led by Germany, the United States, Turkey, Iran, and France.
- DefusedCyber reports honeypot telemetry, dated 2026-08-11, showing a spike in reconnaissance against internet-exposed vCenter instances — repeated POST /sdk/ RetrieveServiceContent probes and /websso SAML enumeration walks — consistent with fingerprinting for CVE-2026-59309; characterized as early-warning reconnaissance rather than confirmed exploitation.
- QUIRSO GmbH publishes its campaign analysis along with a generic YARA rule for detecting reverse_ssh client binaries.
- QUIRSO's findings receive broad security-media coverage (BleepingComputer, The Hacker News, SecurityWeek, GBHackers, Cybersecurity News), raising public awareness of the ongoing exploitation.
Update history for TL-2026-1764
- 2026-08-14 — Global Exploitation Campaign Targets Critical VMware vCenter Syslog Directory Traversal Flaw (CVE-2026-59310): What changed No change to severity, exploitability, status, CVSS, or attribution confidence — still CRITICAL / ACTIVE / ACTIVE / 9.8 / LOW. The newer report adds a second, distinct historical tooling-precedent thread (PurpleHaze/GOREshell/U
- 2026-08-13 — CVE-2026-59310: Critical VMware vCenter Syslog Server Directory Traversal RCE Actively Exploited for Reverse SSH Persistence: What changed Exploitability THEORETICAL → ACTIVE for CVE-2026-59310: QUIRSO GmbH confirms in-the-wild exploitation beginning 2026-08-03, five days after Broadcom's disclosure, reaching 361 victim IPs across 47 countries by 2026-08-07. New i
- 2026-08-02 — Critical VMware vCenter Flaws: Authentication Bypass and Directory Traversal RCE (CVE-2026-59309, CVE-2026-59310): What changed No escalation: severity remains CRITICAL, exploitability remains THEORETICAL, status ACTIVE, CVSS 9.8 unchanged. No known in-the-wild exploitation or public PoC in either report. New indicators (1) 1 new entity indicator: UNC38
- 2026-08-02 — Critical VMware vCenter Authentication Bypass and Directory Traversal Vulnerabilities Fixed (CVE-2026-59309, CVE-2026-59310): What changed No severity/exploitability/status change — record remains CRITICAL / CVSS 9.8 / THEORETICAL / ACTIVE. Neither report shows PoC code or in-the-wild exploitation. The update corroborates the disclosure via a second national CERT
- 2026-08-02 — Broadcom Patches Critical VMware ESXi VMXNET3 Vulnerability (CVE-2026-47876) Enabling Host Code Execution via VM Escape: What changed No severity, exploitability, or status escalation — core facts are unchanged and corroborated. Enrichment only: the newer report supplies the specific ZDI advisory (ZDI-26-495) and internal tracking case (ZDI-CAN-31293) for CVE
- 2026-08-02 — VMware ESXi VM Escape Vulnerability (CVE-2026-47876) — Broadcom Patches Five Critical Flaws in ESX, vCenter, Workstation, and Fusion (VMSA-2026-0006): What changed No severity/exploitability/status escalation — both records agree CRITICAL/CVSS 9.8/THEORETICAL exploitability/ACTIVE status, with no confirmed in-the-wild exploitation and no public PoC. The newer report enriches the record wi
- 2026-07-30 — VMware Patches Three Critical Flaws (CVE-2026-59309, CVE-2026-59310, CVE-2026-47876) Enabling Authentication Bypass and VM Escape: What changed No severity/exploitability/status escalation — both reports agree CRITICAL/9.8/THEORETICAL with patches already available. What's new is scope and depth: two companion CVEs from the same VMSA-2026-0006 disclosure (CVE-2026-4170
Sources cited for Three Critical VMware Flaws (CVE-2026-59309, CVE-2026-59310
- Three Critical VMware Flaws Allow Auth Bypass, Code Execution, and VM Escape
- vcf-security-and-compliance-guidelines: security-advisories/vmsa-2026-0006
- VMSA-2026-0006 Support Content Notification
- Critical VM Escape Vulnerability Patched in VMware ESXi
- Broadcom Patches CVE-2026-59309 & CVE-2026-59310 (CVSS 9.8) in VMware
- Critical VMware Flaws Allow Attackers to Bypass Authentication and Gain Access to the System
- Critical VMware vCenter Flaws Let Remote Attackers Bypass Authentication and Execute Code
- Broadcom Patches Critical VMware ESXi Vulnerability Enabling Host Code Execution
- VMware Telco Cloud response to VMSA-2026-0006
Detection coverage for TL-2026-1764
As of 2026-08-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1764 across Splunk SPL, Microsoft KQL and Sigma, covering 56 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.