CVE-2026-59309

Published Jul 30, 2026

Last updated 2 months ago

CVSS critical 9.8

VDI

Network

Server

VMware vCenter

VMware Directory Service

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-59309 is an authentication bypass vulnerability found within the VMware Directory Service component of VMware vCenter Server. This flaw allows a malicious actor with network access to vCenter to bypass authentication mechanisms and gain unauthorized access to the system. Broadcom, the vendor, disclosed this vulnerability on July 29, 2026, as part of a broader security advisory. While the vulnerability enables unauthorized access, Broadcom has not publicly detailed the precise bypass mechanism or the specific privilege level an attacker might achieve after successful exploitation.

Description: VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized access to the system.
Source: security@vmware.com
NVD status: Analyzed
Products: vcenter_server

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

security@vmware.com: CWE-303

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "6B17478A-E6D9-4C6B-8810-7E1BC9E7392F",
            "versionEndExcluding": "8.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:-:*:*:*:*:*:*",
            "matchCriteriaId": "CC974CA1-88D3-42E4-BF1F-28870F8171B5",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:a:*:*:*:*:*:*",
            "matchCriteriaId": "EFE63984-F69B-4593-9AEC-D179D6D98B08",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:b:*:*:*:*:*:*",
            "matchCriteriaId": "34D1F3B3-8E3F-4E4D-8EE6-2F593663B5CC",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:c:*:*:*:*:*:*",
            "matchCriteriaId": "16F3D992-9F48-4604-9AAF-DC2D1CE98BE2",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update1:*:*:*:*:*:*",
            "matchCriteriaId": "C745A7E6-4760-48CD-B7C4-1C2C20217F21",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update1a:*:*:*:*:*:*",
            "matchCriteriaId": "A5522514-8ED9-45DB-9036-33FE40D77E7D",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update1b:*:*:*:*:*:*",
            "matchCriteriaId": "8C27C660-E917-4944-8B4C-41D9622B76D7",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update1c:*:*:*:*:*:*",
            "matchCriteriaId": "56CFB469-B3E6-4503-A47C-D18206D4D19A",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update1d:*:*:*:*:*:*",
            "matchCriteriaId": "67024A43-9E13-4F4E-B711-731792DA3840",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update1e:*:*:*:*:*:*",
            "matchCriteriaId": "1188E9D6-53AD-40D0-8146-3728D071008D",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update2:*:*:*:*:*:*",
            "matchCriteriaId": "604F559F-1775-4F29-996E-9079B99345B6",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update2a:*:*:*:*:*:*",
            "matchCriteriaId": "61DC9400-5AEE-49AC-9925-0A96E32BD8C0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update2b:*:*:*:*:*:*",
            "matchCriteriaId": "98C1B77E-AB0E-4E8A-8294-2D3D230CDF9B",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update2c:*:*:*:*:*:*",
            "matchCriteriaId": "8EC8BEF1-7908-46C0-841A-834778D1A863",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update2d:*:*:*:*:*:*",
            "matchCriteriaId": "89D5A7F9-3183-4EE7-828C-13BB9169E199",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update2e:*:*:*:*:*:*",
            "matchCriteriaId": "9EB94E5F-9AFB-471C-887C-4C53B5169347",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update3:*:*:*:*:*:*",
            "matchCriteriaId": "D8C5E404-9A83-472C-AE97-25DAE332C327",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update3a:*:*:*:*:*:*",
            "matchCriteriaId": "78312C9E-4653-4C79-9886-A7A63DB98262",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update3b:*:*:*:*:*:*",
            "matchCriteriaId": "722B1899-0229-4BEA-94C4-1E475406E7AF",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update3c:*:*:*:*:*:*",
            "matchCriteriaId": "E1EA338E-4263-42A9-8E91-C3D91A7F8AD1",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update3d:*:*:*:*:*:*",
            "matchCriteriaId": "3EFDF451-E83B-4340-BF06-AA017B042841",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update3e:*:*:*:*:*:*",
            "matchCriteriaId": "20D28DF8-BAD2-4613-9325-A55B06FB1F21",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update3g:*:*:*:*:*:*",
            "matchCriteriaId": "FF925343-3889-46EC-87C5-82B8C3DC33ED",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update3h:*:*:*:*:*:*",
            "matchCriteriaId": "D9BD9CEF-D37E-45AF-883F-120C32849E14",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update3i:*:*:*:*:*:*",
            "matchCriteriaId": "1D402845-1C50-40CE-BAA2-CDD5615B660D",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update3j:*:*:*:*:*:*",
            "matchCriteriaId": "9552133F-9C74-4368-857A-BAFA182BE8EA",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      },
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:vmware:telco_cloud_infrastructure:3.0:*:*:*:*:*:*:*",
            "matchCriteriaId": "D11103A7-6AB5-4E78-BE11-BC2A04A09F19",
            "vulnerable": false
          },
          {
            "criteria": "cpe:2.3:a:vmware:telco_cloud_platform:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "320FDFEE-22D1-4650-B177-BF7B1E750D45",
            "versionEndIncluding": "5.2",
            "versionStartIncluding": "3.0",
            "vulnerable": false
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "AND"
  },
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "45C693CF-0995-4332-9B1E-018EBCDAF83A",
            "versionEndExcluding": "9.0.2.0100",
            "versionStartIncluding": "9.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "C014E906-B622-424E-BFF9-660187C73C54",
            "versionEndExcluding": "9.1.0.0300",
            "versionStartIncluding": "9.1",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      },
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:vmware:cloud_foundation:-:*:*:*:*:*:*:*",
            "matchCriteriaId": "31A7BB38-3238-413E-9736-F1A165D40867",
            "vulnerable": false
          },
          {
            "criteria": "cpe:2.3:a:vmware:vsphere_foundation:-:*:*:*:*:*:*:*",
            "matchCriteriaId": "03AD0AB7-45A3-4DC7-923D-1166346EEA12",
            "vulnerable": false
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "AND"
  }
]

References

Sources include official advisories and independent security research.