Vulnerability Intelligence Report
vCenter authentication-bypass vulnerability
CVE-2026-59309
VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized access to the system.
No Active Exploit Signals
CVSS Base Score
9.8
CRITICAL
Exploitability:3.9
Impact Score:5.9
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-303 ↗CWE-303 Incorrect implementation of authentication algorithm
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| VMware | Cloud Foundation | 9.1.x.x (affected), 9.0.x.x (affected), 5.x (affected) |
| VMware | vSphere Foundation | 9.1.x.x (affected), 9.0.x.x (affected) |
| VMware | vCenter | 9.1.x.x < 9.1.0.0300 (affected), 9.0.x.x < 9.0.2.0100 (affected), 8.0 < 8.0 U3k (affected) |
| VMware | Telco Cloud Infrastructure | 3.0 (affected) |
| VMware | Telco Cloud Platform | 5.1.x (affected), 5.0.x (affected), 4.x (affected), 3.0 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | VMware by Broadcom · Vendor · USA |
| Reserved | 2026-07-04T18:13:57 |
| Published | 2026-07-30T12:19:52 |
| Patch Date | 2026-07-29 |
| Last Updated | 2026-07-30T15:08:05 |
Community Chatter & Buzz