CVE-2026-59309
critical · 9.8VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized access to the system.
9.8
CVSS
7.9%
EPSS (exploit prob.)
94th
EPSS percentile
2026-07-30
Published
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-303
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| vmware | vcenter_server | < 8.0 |
| vmware | vcenter_server | 8.0 |
| vmware | vcenter_server | 8.0 |
| vmware | vcenter_server | 8.0 |
| vmware | vcenter_server | 8.0 |
| vmware | vcenter_server | 8.0 |
| vmware | vcenter_server | 8.0 |
| vmware | vcenter_server | 8.0 |
| vmware | vcenter_server | 8.0 |
| vmware | vcenter_server | 8.0 |
| vmware | vcenter_server | 8.0 |
| vmware | vcenter_server | 8.0 |
| vmware | vcenter_server | 8.0 |
| vmware | vcenter_server | 8.0 |
| vmware | vcenter_server | 8.0 |
| vmware | vcenter_server | 8.0 |
| vmware | vcenter_server | 8.0 |
| vmware | vcenter_server | 8.0 |
| vmware | vcenter_server | 8.0 |
| vmware | vcenter_server | 8.0 |
| vmware | vcenter_server | 8.0 |
| vmware | vcenter_server | 8.0 |
| vmware | vcenter_server | 8.0 |
| vmware | vcenter_server | 8.0 |
| vmware | vcenter_server | 8.0 |
| vmware | vcenter_server | 8.0 |
| vmware | vcenter_server | 8.0 |
| vmware | telco_cloud_infrastructure | 3.0 |
| vmware | telco_cloud_platform | >= 3.0, <= 5.2 |
| vmware | vcenter_server | >= 9.0, < 9.0.2.0100 |
| vmware | vcenter_server | >= 9.1, < 9.1.0.0300 |
| vmware | cloud_foundation | all versions |
| vmware | vsphere_foundation | all versions |
Check a specific version with /api/v1/cve/match.
References
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2026-59309