CVE-2026-59309

Published Jul 30, 2026

Last updated 2 hours ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-59309 is an authentication bypass vulnerability found within the VMware Directory Service component of VMware vCenter Server. This flaw allows a malicious actor with network access to vCenter to bypass authentication mechanisms and gain unauthorized access to the system. Broadcom, the vendor, disclosed this vulnerability on July 29, 2026, as part of a broader security advisory. While the vulnerability enables unauthorized access, Broadcom has not publicly detailed the precise bypass mechanism or the specific privilege level an attacker might achieve after successful exploitation.

Description: VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized access to the system.
Source: security@vmware.com
NVD status: Received

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

security@vmware.com: CWE-303

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 8

References