A path traversal in VMware vCenter (CVE-2026-59310) — what it means to lose the management plane of a virtualized estate
VMware vCenter, the management server for a virtualized estate, contains a flaw in how it validates pathnames. An attacker with network access to vCenter can execute arbitrary code. CISA added it to the KEV catalog on 2026-08-18 with a due date of 2026-08-21 — three days after listing.
Key facts
- CVE IDCVE-2026-59310
- Affected (vendor / product)Broadcom VMware vCenter
- CWECWE-22
- ExploitationListed in CISA KEV (exploitation confirmed); also confirmed used in ransomware
- Remediation due2026-08-21 (U.S. federal civilian agencies, BOD 22-01)
Key points
- The affected product is Broadcom VMware vCenter; CWE-22, improper limitation of a pathname (path traversal).
- The catalog records that a threat actor with network access to vCenter can execute arbitrary code.
- vCenter is the management plane of a virtualized environment — the layer that creates, moves, clones, and deletes virtual machines.
- Where a path traversal permits a write, files can be placed somewhere that gets executed, turning file manipulation into code execution.
- Added to KEV 2026-08-18 with a due date of 2026-08-21 — three days. Other entries carry fourteen-day dates; urgency is not uniform.
- Holding the management plane allows running VMs to be stopped, disks cloned and new machines created.
1The layer called the management plane
A virtualized environment separates the layer of virtual machines actually running the business from the layer that creates, moves, clones, and deletes them. vCenter is the latter — the management plane. Holding it is different from breaking into an individual virtual machine. From the management plane one can stop running machines, clone their disks, and create new ones.
Defending each machine individually does not help if the management plane falls; the whole estate is affected at once.
2Why a path traversal becomes code execution
Path traversal is a flaw where the logic deciding where a file is read or written checks the path inadequately, allowing an escape from the intended area. On a read it is an information disclosure; where a write is possible, files can be placed somewhere that gets executed.
Configuration files, scripts read at startup, directories a web application serves — depending on where a write can land, plain file manipulation turns into code execution.
3The three-day treatment
Listing was 2026-08-18 and the due date is 2026-08-21 — three days. Other entries this site holds as of 2026-08-28 carry fourteen-day dates, so urgency varies per entry under BOD 26-04. A management-plane server is also a layer where downtime is hard to schedule, since taking it offline for an update affects everything under it. A three-day deadline does not work unless that coordination is agreed in advance.
4The layer running the work, and the layer operating it
A virtualised environment separates the layer of virtual machines actually running the work from the management layer that creates, moves, clones and deletes them. vCenter is the latter.
Added on 18 August 2026 with a remediation date of 21 August, the grace period is three days. A management-plane server is also a layer where downtime is hard to arrange, and three days holds only if that arrangement was settled in peacetime. Restricting network access to the management plane and preparing the update procedure in advance are the practical preparations.
Why it matters
A management-plane server's compromise reaches the whole environment rather than one system. Taking it offline to update affects everything beneath it, so entries with deadlines measured in days depend on procedures agreed in advance. Practically, the defenses are limiting which networks can reach the management plane and keeping management credentials separate from those used for business systems.
FAQ
What is the management plane?
Why does a path traversal become code execution?
Is an internal server still at risk?
Sources (primary)
This article is an independent organization based on the U.S. official data below. Always verify the exact, latest details and applicability with the official and vendor sources.
- CISA KEV Catalog (known exploited list)
- NVD (CVE details / CVSS)
- Vendor / reference advisory
- This product uses data from the NVD API but is not endorsed or certified by the NVD. KEV data is CC0 (public domain).