Attackers Are Actively Scanning for VMware's Critical vCenter Auth Bypass (CVE-2026-59309, CVSS 9.8)

Cybersecurity researchers at Defused Cyber reported on August 11 a sharp spike in scanning activity against VMware vCenter, consistent with attackers hunting for systems still exposed to CVE-2026-59309 — a critical authentication bypass in the VMware Directory Service (vmdir) that underpins vCenter Single Sign-On.

The vulnerability carries a CVSS score of 9.8. An attacker with only network access to vCenter — no credentials, no user interaction, no prior privileges — can bypass authentication entirely and walk into the management plane with full administrative control over every VM, datastore, and workload the instance manages. Broadcom disclosed it on July 29 in advisory VMSA-2026-0006, alongside a companion remote-code-execution flaw, CVE-2026-59310.

Defused Cyber’s honeypots logged the fingerprinting pattern directly: version-probe requests via POST /sdk/ (RetrieveServiceContent) and exploration of the /websso SAML SSO flow. That’s reconnaissance, not confirmed exploitation — the requests identify exposed, unpatched systems rather than compromise them outright. But it’s the standard precursor to mass exploitation once a working proof-of-concept circulates, and CVE-2026-59309 has been public for two weeks, plenty of time for one to surface.

Broadcom has confirmed no workaround exists. Patching is the only fix. VMware Cloud Foundation and vSphere Foundation on the 9.1.x branch need to move to 9.1.0.0300; the 9.0.x branch needs 9.0.2.0100. Both updates are cumulative and also close CVE-2026-59310, so a single upgrade clears both critical issues in one pass. Affected products span vCenter Server 8.0, 9.0.x, and 9.1.x.

If your organization runs vCenter and hasn’t applied VMSA-2026-0006 yet, treat this as urgent. vCenter typically sits at the center of an enterprise’s virtualization estate — full admin access to it means full admin access to every VM it manages, which for most environments is the entire datacenter. Check external exposure first: vCenter should never be reachable directly from the internet, and if yours is, isolate it behind a VPN or bastion immediately while the patch rolls out. Then confirm your build number against Broadcom’s advisory, since “patched last month” and “patched against this specific CVE” aren’t always the same claim.

Sources

• Hackers Actively Scanning to Exploit VMware VCenter Vulnerabilities
• CVE-2026-59309 – Authentication Bypass – VMware vCenter Server 8.0, 9.0.x, 9.1.x
• Critical VMware vCenter Vulnerabilities Allow Authentication Bypass and Remote Code Execution