vCenter authentication-bypass vulnerability
Priority MEDIUM 50CWE-303Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized access to the system.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00611 49th percentileScored 2026-11-07
Fix Fixed vCenter (VMware): 9.1.0.0300, 9.0.2.0100, 8.0 U3k
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| VMware | Cloud Foundation | 9.1.x.x; 9.0.x.x; 5.x | — | No fix listed | CNA |
| VMware | vSphere Foundation | 9.1.x.x; 9.0.x.x | — | No fix listed | CNA |
| VMware | vCenter | 9.1.x.x to before 9.1.0.0300; 9.0.x.x to before 9.0.2.0100; 8.0 to before 8.0 U3k | 9.1.0.0300, 9.0.2.0100, 8.0 U3k | Patch available | CNA |
| VMware | Telco Cloud Infrastructure | 3.0 | — | No fix listed | CNA |
| VMware | Telco Cloud Platform | 5.1.x; 5.0.x; 4.x; 3.0 | — | No fix listed | CNA |
- Cloud Foundation VendorVMware Affected 9.1.x.x; 9.0.x.x; 5.x Fixed in — No fix listed CNA
- vSphere Foundation VendorVMware Affected 9.1.x.x; 9.0.x.x Fixed in — No fix listed CNA
- vCenter VendorVMware Affected 9.1.x.x to before 9.1.0.0300; 9.0.x.x to before 9.0.2.0100; 8.0 to before 8.0 U3k Fixed in 9.1.0.0300, 9.0.2.0100, 8.0 U3k Patch available CNA
- Telco Cloud Infrastructure VendorVMware Affected 3.0 Fixed in — No fix listed CNA
- Telco Cloud Platform VendorVMware Affected 5.1.x; 5.0.x; 4.x; 3.0 Fixed in — No fix listed CNA
CPE configurations NVD · 32
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vmware:vcenter_server:*:*:*:*:*:*:*:* | before 8.0 | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:-:*:*:*:*:*:* | 8.0 | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:a:*:*:*:*:*:* | 8.0 a | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:b:*:*:*:*:*:* | 8.0 b | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:c:*:*:*:*:*:* | 8.0 c | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:update1:*:*:*:*:*:* | 8.0 update1 | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:update1a:*:*:*:*:*:* | 8.0 update1a | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:update1b:*:*:*:*:*:* | 8.0 update1b | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:update1c:*:*:*:*:*:* | 8.0 update1c | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:update1d:*:*:*:*:*:* | 8.0 update1d | Vulnerable | VMware |
- cpe:2.3:a:vmware:vcenter_server:*:*:*:*:*:*:*:* Versions before 8.0 Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:-:*:*:*:*:*:* Versions 8.0 Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:a:*:*:*:*:*:* Versions 8.0 a Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:b:*:*:*:*:*:* Versions 8.0 b Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:c:*:*:*:*:*:* Versions 8.0 c Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:update1:*:*:*:*:*:* Versions 8.0 update1 Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:update1a:*:*:*:*:*:* Versions 8.0 update1a Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:update1b:*:*:*:*:*:* Versions 8.0 update1b Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:update1c:*:*:*:*:*:* Versions 8.0 update1c Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:update1d:*:*:*:*:*:* Versions 8.0 update1d Vulnerable ·VMware
Show 22 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vmware:vcenter_server:8.0:update1e:*:*:*:*:*:* | 8.0 update1e | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:update2:*:*:*:*:*:* | 8.0 update2 | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:update2a:*:*:*:*:*:* | 8.0 update2a | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:update2b:*:*:*:*:*:* | 8.0 update2b | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:update2c:*:*:*:*:*:* | 8.0 update2c | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:update2d:*:*:*:*:*:* | 8.0 update2d | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:update2e:*:*:*:*:*:* | 8.0 update2e | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:update3:*:*:*:*:*:* | 8.0 update3 | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:update3a:*:*:*:*:*:* | 8.0 update3a | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:update3b:*:*:*:*:*:* | 8.0 update3b | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:update3c:*:*:*:*:*:* | 8.0 update3c | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:update3d:*:*:*:*:*:* | 8.0 update3d | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:update3e:*:*:*:*:*:* | 8.0 update3e | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:update3g:*:*:*:*:*:* | 8.0 update3g | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:update3h:*:*:*:*:*:* | 8.0 update3h | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:update3i:*:*:*:*:*:* | 8.0 update3i | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:update3j:*:*:*:*:*:* | 8.0 update3j | Vulnerable | VMware |
| cpe:2.3:a:vmware:telco_cloud_infrastructure:3.0:*:*:*:*:*:*:* | 3.0 | Running on | VMware |
| cpe:2.3:a:vmware:telco_cloud_platform:*:*:*:*:*:*:*:* | 3.0 – 5.2 | Running on | VMware |
| cpe:2.3:a:vmware:vcenter_server:*:*:*:*:*:*:*:* | 9.0 to before 9.0.2.0100; 9.1 to before 9.1.0.0300 | Vulnerable | VMware |
| cpe:2.3:a:vmware:cloud_foundation:-:*:*:*:*:*:*:* | not specified by NVD | Running on | VMware |
| cpe:2.3:a:vmware:vsphere_foundation:-:*:*:*:*:*:*:* | not specified by NVD | Running on | VMware |
- cpe:2.3:a:vmware:vcenter_server:8.0:update1e:*:*:*:*:*:* Versions 8.0 update1e Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:update2:*:*:*:*:*:* Versions 8.0 update2 Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:update2a:*:*:*:*:*:* Versions 8.0 update2a Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:update2b:*:*:*:*:*:* Versions 8.0 update2b Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:update2c:*:*:*:*:*:* Versions 8.0 update2c Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:update2d:*:*:*:*:*:* Versions 8.0 update2d Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:update2e:*:*:*:*:*:* Versions 8.0 update2e Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:update3:*:*:*:*:*:* Versions 8.0 update3 Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:update3a:*:*:*:*:*:* Versions 8.0 update3a Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:update3b:*:*:*:*:*:* Versions 8.0 update3b Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:update3c:*:*:*:*:*:* Versions 8.0 update3c Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:update3d:*:*:*:*:*:* Versions 8.0 update3d Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:update3e:*:*:*:*:*:* Versions 8.0 update3e Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:update3g:*:*:*:*:*:* Versions 8.0 update3g Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:update3h:*:*:*:*:*:* Versions 8.0 update3h Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:update3i:*:*:*:*:*:* Versions 8.0 update3i Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:update3j:*:*:*:*:*:* Versions 8.0 update3j Vulnerable ·VMware
- cpe:2.3:a:vmware:telco_cloud_infrastructure:3.0:*:*:*:*:*:*:* Versions 3.0 Running on ·VMware
- cpe:2.3:a:vmware:telco_cloud_platform:*:*:*:*:*:*:*:* Versions 3.0 – 5.2 Running on ·VMware
- cpe:2.3:a:vmware:vcenter_server:*:*:*:*:*:*:*:* Versions 9.0 to before 9.0.2.0100; 9.1 to before 9.1.0.0300 Vulnerable ·VMware
- cpe:2.3:a:vmware:cloud_foundation:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·VMware
- cpe:2.3:a:vmware:vsphere_foundation:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·VMware
Remediation
- Fix · CNA vCenter (VMware) Fixed in 9.1.0.0300, 9.0.2.0100, 8.0 U3k
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
VMware vCenter 8.0 U3k, 9.0.2.0100, 9.1.0.0300
2 records Highest priority Priority CRITICAL 1 CRITICAL, 1 MEDIUM
Other records, highest priority first
- TI-2026-42442 vCenter directory-traversal vulnerabilityPriority CRITICAL 100
Timeline
- 2026-10-02 Threatist record created from CVE-2026-59309
- 2026-10-03 Alias added: GHSA-fcv2-9hgc-5mgq
References
More VMware Vcenter Server vulnerabilities
- TI-2026-42442 vCenter directory-traversal vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2024-26040 Privilege escalation in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
- TI-2024-26039 Heap-overflow in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
- TI-2024-24610 Out-of-bounds write in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
- TI-2023-16914 VMware vCenter Server Out-of-Bounds Write Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2021-05049 Path traversal in VMware vCenter Server, VMware Cloud Foundation KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-59309 · CVE Program
- CVE-2026-59309 · NVD
- FIRST EPSS
- GHSA-fcv2-9hgc-5mgq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences