Critical9.8VMware (Broadcom) Updated

vCenter authentication-bypass vulnerability

CVE-2026-59309 Published Jul 30, 2026Updated by vendor Jul 30, 2026

CVE-2026-59309

Affected products & platforms

VMware (Broadcom)ESXivCenterCloud FoundationvSphere

Summary

VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized access to the system. Affected products named by the advisory: Cloud Foundation; vSphere Foundation; Telco Cloud Infrastructure; Telco Cloud Platform.

Affected versions

Cloud Foundation 9.1.x.x
Cloud Foundation 9.0.x.x
Cloud Foundation 5.x
vSphere Foundation 9.1.x.x
vSphere Foundation 9.0.x.x
vCenter 9.1.x.x before 9.1.0.0300
vCenter 9.0.x.x before 9.0.2.0100
vCenter 8.0 before 8.0 U3k
Telco Cloud Infrastructure 3.0
Telco Cloud Platform 5.1.x
Telco Cloud Platform 5.0.x
Telco Cloud Platform 4.x

Official advisory · high-confidence parse· fetched 3 hours ago·verify at source

Fixed versions

9.1.0.0300
9.0.2.0100
8.0 U3k

Official advisory · high-confidence parse· fetched 3 hours ago·verify at source

Mitigation

Upgrade to a fixed release: 9.1.0.0300, 9.0.2.0100, 8.0 U3k. That is the remediation for this advisory.

The vendor advisory may list additional interim mitigations or workarounds not captured here — review it before change work.

Official advisory · high-confidence parse· fetched 3 hours ago·verify at source

Sources

Official and corroborating records used to build this advisory.

Official vendor advisoryofficial
Official advisory page fetched and parsed for the summary, affected/fixed versions and remediation guidance it provides.
VMware (Broadcom)
CVE.org CNA recordCVE.org
Independent CNA record used for near-real-time discovery and missed-CVE reconciliation.
CVE Program
CVE.org CNA affected-product recordCVE.org
Structured CNA affected[] data independently confirmed the affected product scope; native advisory content remains authoritative.
CVE Program

Cross-references

Validate CVE metadata against the authoritative registries.

CVE-2026-59309NVD CVE.org MITRE

Official resources

Broadcom support downloads (ESXi / vCenter patches) (target: 9.1.0.0300 / 9.0.2.0100 / 8.0)
Official documentation
This advisory names 9.1.0.0300 / 9.0.2.0100 / 8.0 as the first fixed releases — official upgrade documentation for vSphere (ESXi / vCenter).
VMware product lifecycle (EOL / support dates)
Release notes
Confirm your release train is still supported before planning the upgrade path.
Broadcom / VMware Security Advisories (VMSA)
Official documentation
Canonical VMSA portal — full advisory text, response matrix and fixed-version tables.
VMware docs on Broadcom TechDocs
Official documentation
Official VMware product documentation, including upgrade and patching guides.

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

vCenter authentication-bypass vulnerability

CVE-2026-59309 Published Jul 30, 2026Updated by vendor Jul 30, 2026

Affected products & platforms

VMware (Broadcom)ESXivCenterCloud FoundationvSphere

Summary

Affected versions

Cloud Foundation 9.1.x.x
Cloud Foundation 9.0.x.x
Cloud Foundation 5.x
vSphere Foundation 9.1.x.x
vSphere Foundation 9.0.x.x
vCenter 9.1.x.x before 9.1.0.0300
vCenter 9.0.x.x before 9.0.2.0100
vCenter 8.0 before 8.0 U3k
Telco Cloud Infrastructure 3.0
Telco Cloud Platform 5.1.x
Telco Cloud Platform 5.0.x
Telco Cloud Platform 4.x

Official advisory · high-confidence parse· fetched 3 hours ago·verify at source

Fixed versions

9.1.0.0300
9.0.2.0100
8.0 U3k

Official advisory · high-confidence parse· fetched 3 hours ago·verify at source

Mitigation

Upgrade to a fixed release: 9.1.0.0300, 9.0.2.0100, 8.0 U3k. That is the remediation for this advisory.

The vendor advisory may list additional interim mitigations or workarounds not captured here — review it before change work.

Official advisory · high-confidence parse· fetched 3 hours ago·verify at source

Sources

Official and corroborating records used to build this advisory.

Official vendor advisoryofficial
Official advisory page fetched and parsed for the summary, affected/fixed versions and remediation guidance it provides.
VMware (Broadcom)
CVE.org CNA recordCVE.org
Independent CNA record used for near-real-time discovery and missed-CVE reconciliation.
CVE Program
CVE.org CNA affected-product recordCVE.org
Structured CNA affected[] data independently confirmed the affected product scope; native advisory content remains authoritative.
CVE Program

Cross-references

Validate CVE metadata against the authoritative registries.

CVE-2026-59309NVD CVE.org MITRE

Official resources

Broadcom support downloads (ESXi / vCenter patches) (target: 9.1.0.0300 / 9.0.2.0100 / 8.0)
Official documentation
This advisory names 9.1.0.0300 / 9.0.2.0100 / 8.0 as the first fixed releases — official upgrade documentation for vSphere (ESXi / vCenter).
VMware product lifecycle (EOL / support dates)
Release notes
Confirm your release train is still supported before planning the upgrade path.
Broadcom / VMware Security Advisories (VMSA)
Official documentation
Canonical VMSA portal — full advisory text, response matrix and fixed-version tables.
VMware docs on Broadcom TechDocs
Official documentation
Official VMware product documentation, including upgrade and patching guides.

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.