CISA confirmó el 18.08.2026 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 21.08.2026.
Acción requerida: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-59310
VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| VMware | Cloud Foundation | 9.1.x.x, 9.0.x.x, 5.x | |
| VMware | Telco Cloud Infrastructure | 3.0 | |
| VMware | Telco Cloud Platform | 5.1.x, 5.0.x, 4.x, 3.0 | |
| VMware | vCenter | 9.1.x.x – < 9.1.0.0300, 9.0.x.x – < 9.0.2.0100, 8.0 – < 8.0 U3k | |
| vmware | vcenter server | < 8.0 | |
| VMware | vSphere Foundation | 9.1.x.x, 9.0.x.x |
cpe:2.3:a:vmware:vcenter_server:*:*:*:*:*:*:*:* < 8.0cpe:2.3:a:vmware:vcenter_server:8.0:-:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:8.0:a:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:8.0:b:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:8.0:c:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:8.0:update1:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:8.0:update1a:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:8.0:update1b:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:8.0:update1c:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:8.0:update1d:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:8.0:update1e:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:8.0:update2:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:8.0:update2a:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:8.0:update2b:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:8.0:update2c:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:8.0:update2d:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:8.0:update2e:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:8.0:update3:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:8.0:update3a:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:8.0:update3b:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:8.0:update3c:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:8.0:update3d:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:8.0:update3e:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:8.0:update3g:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:8.0:update3h:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:8.0:update3i:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:8.0:update3j:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:*:*:*:*:*:*:*:* ≥ 9.0 < 9.0.2.0100cpe:2.3:a:vmware:vcenter_server:*:*:*:*:*:*:*:* ≥ 9.1 < 9.1.0.0300Nuestro sensor honeypot gratuito y de código abierto espera en puertos que su servidor no usa y reporta a una lista compartida los escáneres y atacantes que se conectan.