Vulnpedia
← All CVEs

CVE-2026-59309

CRITICAL 9.8

Published 2026-07-30 · Last modified 2026-07-30

VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized access to the system.

ELEVATED IMPACT

Severe if exploited (CVSS 9.8), but no known exploitation and low modeled probability. Patch on a normal cadence.

Exploitation likelihood

7.9%chance of exploitation in 30 days · 94th percentile

○ In CISA KEV ○ Public exploit / PoC

Impact if exploited

9.8CVSS 3.1 · CRITICAL

  • ConfidentialityHigh
  • IntegrityHigh
  • AvailabilityHigh

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept & exploit code

Test against your own equipment

curl -s https://vulnpedia.com/cve/CVE-2026-59309/poc.jsonMachine-readable PoC index for this CVE (for automation).

Listed for defensive triage, patch verification, and authorized testing on systems you own. Machine-readable: /cve/CVE-2026-59309/poc.json

Affected

Vendors Vmware

Products Cloud Foundation Vsphere Foundation Vcenter Telco Cloud Infrastructure Telco Cloud Platform Vcenter Server

Weakness (CWE)

  • CWE-303: Incorrect implementation of authentication algorithm

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Known Affected Software Configurations

VendorProductVersion range
VmwareVcenter Server< 8.0
VmwareVcenter Server8.0
VmwareVcenter Server8.0
VmwareVcenter Server8.0
VmwareVcenter Server8.0
VmwareVcenter Server8.0
VmwareVcenter Server8.0
VmwareVcenter Server8.0
VmwareVcenter Server8.0
VmwareVcenter Server8.0
VmwareVcenter Server8.0
VmwareVcenter Server8.0
VmwareVcenter Server8.0
VmwareVcenter Server8.0
VmwareVcenter Server8.0
VmwareVcenter Server8.0
VmwareVcenter Server8.0
VmwareVcenter Server8.0
VmwareVcenter Server8.0
VmwareVcenter Server8.0
VmwareVcenter Server8.0
VmwareVcenter Server8.0
VmwareVcenter Server8.0
VmwareVcenter Server8.0
VmwareVcenter Server8.0
VmwareVcenter Server8.0
VmwareVcenter Server8.0
VmwareVcenter Server≥ 9.0 and < 9.0.2.0100
VmwareVcenter Server≥ 9.1 and < 9.1.0.0300

All CVSS metrics

  • CRITICAL 9.8 v3.1 · CNA Primary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • CRITICAL 9.8 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Advisories

Sources: NVD · CVE.org · EPSS