{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-59309", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "state": "PUBLISHED", "assignerShortName": "vmware", "dateReserved": "2026-07-04T18:13:57.026Z", "datePublished": "2026-07-30T12:19:52.390Z", "dateUpdated": "2026-07-30T15:08:05.176Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2026-07-30T12:27:12.963Z"}, "title": "vCenter authentication-bypass vulnerability", "datePublic": "2026-07-29T04:54:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-303", "description": "CWE-303 Incorrect implementation of authentication algorithm", "type": "CWE"}]}], "affected": [{"vendor": "VMware", "product": "Cloud Foundation", "versions": [{"status": "affected", "version": "9.1.x.x"}, {"status": "affected", "version": "9.0.x.x"}, {"status": "affected", "version": "5.x"}], "defaultStatus": "unaffected"}, {"vendor": "VMware", "product": "vSphere Foundation", "versions": [{"status": "affected", "version": "9.1.x.x"}, {"status": "affected", "version": "9.0.x.x"}], "defaultStatus": "unaffected"}, {"vendor": "VMware", "product": "vCenter", "versions": [{"status": "affected", "version": "9.1.x.x", "lessThan": "9.1.0.0300", "versionType": "custom"}, {"status": "affected", "version": "9.0.x.x", "lessThan": "9.0.2.0100", "versionType": "custom"}, {"status": "affected", "version": "8.0", "lessThan": "8.0 U3k", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "VMware", "product": "Telco Cloud Infrastructure", "versions": [{"status": "affected", "version": "3.0"}], "defaultStatus": "unaffected"}, {"vendor": "VMware", "product": "Telco Cloud Platform", "versions": [{"status": "affected", "version": "5.1.x"}, {"status": "affected", "version": "5.0.x"}, {"status": "affected", "version": "4.x"}, {"status": "affected", "version": "3.0"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service.\u00a0A malicious actor with network access to vCenter\u00a0may exploit this issue to bypass authentication and gain unauthorized access to the system.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service.&nbsp;<span>A malicious actor with network access to vCenter&nbsp;may exploit this issue to bypass authentication and gain unauthorized access to the system.</span><br><br>"}]}], "references": [{"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "CRITICAL", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.4"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-30T15:07:53.144480Z", "id": "CVE-2026-59309", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-30T15:08:05.176Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-59309", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-30T15:07:53.144480Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-30T15:08:00.799Z"}}], "cna": {"title": "vCenter authentication-bypass vulnerability", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "VMware", "product": "Cloud Foundation", "versions": [{"status": "affected", "version": "9.1.x.x"}, {"status": "affected", "version": "9.0.x.x"}, {"status": "affected", "version": "5.x"}], "defaultStatus": "unaffected"}, {"vendor": "VMware", "product": "vSphere Foundation", "versions": [{"status": "affected", "version": "9.1.x.x"}, {"status": "affected", "version": "9.0.x.x"}], "defaultStatus": "unaffected"}, {"vendor": "VMware", "product": "vCenter", "versions": [{"status": "affected", "version": "9.1.x.x", "lessThan": "9.1.0.0300", "versionType": "custom"}, {"status": "affected", "version": "9.0.x.x", "lessThan": "9.0.2.0100", "versionType": "custom"}, {"status": "affected", "version": "8.0", "lessThan": "8.0 U3k", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "VMware", "product": "Telco Cloud Infrastructure", "versions": [{"status": "affected", "version": "3.0"}], "defaultStatus": "unaffected"}, {"vendor": "VMware", "product": "Telco Cloud Platform", "versions": [{"status": "affected", "version": "5.1.x"}, {"status": "affected", "version": "5.0.x"}, {"status": "affected", "version": "4.x"}, {"status": "affected", "version": "3.0"}], "defaultStatus": "unaffected"}], "datePublic": "2026-07-29T04:54:00.000Z", "references": [{"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017"}], "x_generator": {"engine": "Vulnogram 1.0.4"}, "descriptions": [{"lang": "en", "value": "VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service.\u00a0A malicious actor with network access to vCenter\u00a0may exploit this issue to bypass authentication and gain unauthorized access to the system.", "supportingMedia": [{"type": "text/html", "value": "VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service.&nbsp;<span>A malicious actor with network access to vCenter&nbsp;may exploit this issue to bypass authentication and gain unauthorized access to the system.</span><br><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-303", "description": "CWE-303 Incorrect implementation of authentication algorithm"}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2026-07-30T12:27:12.963Z"}}}, "cveMetadata": {"cveId": "CVE-2026-59309", "state": "PUBLISHED", "dateUpdated": "2026-07-30T15:08:05.176Z", "dateReserved": "2026-07-04T18:13:57.026Z", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "datePublished": "2026-07-30T12:19:52.390Z", "assignerShortName": "vmware"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Cloud Foundation", "vendor": "VMware", "versions": [{"status": "affected", "version": "9.1.x.x"}, {"status": "affected", "version": "9.0.x.x"}, {"status": "affected", "version": "5.x"}]}, {"defaultStatus": "unaffected", "product": "vSphere Foundation", "vendor": "VMware", "versions": [{"status": "affected", "version": "9.1.x.x"}, {"status": "affected", "version": "9.0.x.x"}]}, {"defaultStatus": "unaffected", "product": "vCenter", "vendor": "VMware", "versions": [{"lessThan": "9.1.0.0300", "status": "affected", "version": "9.1.x.x", "versionType": "custom"}, {"lessThan": "9.0.2.0100", "status": "affected", "version": "9.0.x.x", "versionType": "custom"}, {"lessThan": "8.0 U3k", "status": "affected", "version": "8.0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Telco Cloud Infrastructure", "vendor": "VMware", "versions": [{"status": "affected", "version": "3.0"}]}, {"defaultStatus": "unaffected", "product": "Telco Cloud Platform", "vendor": "VMware", "versions": [{"status": "affected", "version": "5.1.x"}, {"status": "affected", "version": "5.0.x"}, {"status": "affected", "version": "4.x"}, {"status": "affected", "version": "3.0"}]}], "source": "security@vmware.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vmware:vcenter_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "6B17478A-E6D9-4C6B-8810-7E1BC9E7392F", "versionEndExcluding": "8.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:-:*:*:*:*:*:*", "matchCriteriaId": "CC974CA1-88D3-42E4-BF1F-28870F8171B5", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:a:*:*:*:*:*:*", "matchCriteriaId": "EFE63984-F69B-4593-9AEC-D179D6D98B08", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:b:*:*:*:*:*:*", "matchCriteriaId": "34D1F3B3-8E3F-4E4D-8EE6-2F593663B5CC", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:c:*:*:*:*:*:*", "matchCriteriaId": "16F3D992-9F48-4604-9AAF-DC2D1CE98BE2", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update1:*:*:*:*:*:*", "matchCriteriaId": "C745A7E6-4760-48CD-B7C4-1C2C20217F21", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update1a:*:*:*:*:*:*", "matchCriteriaId": "A5522514-8ED9-45DB-9036-33FE40D77E7D", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update1b:*:*:*:*:*:*", "matchCriteriaId": "8C27C660-E917-4944-8B4C-41D9622B76D7", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update1c:*:*:*:*:*:*", "matchCriteriaId": "56CFB469-B3E6-4503-A47C-D18206D4D19A", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update1d:*:*:*:*:*:*", "matchCriteriaId": "67024A43-9E13-4F4E-B711-731792DA3840", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update1e:*:*:*:*:*:*", "matchCriteriaId": "1188E9D6-53AD-40D0-8146-3728D071008D", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update2:*:*:*:*:*:*", "matchCriteriaId": "604F559F-1775-4F29-996E-9079B99345B6", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update2a:*:*:*:*:*:*", "matchCriteriaId": "61DC9400-5AEE-49AC-9925-0A96E32BD8C0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update2b:*:*:*:*:*:*", "matchCriteriaId": "98C1B77E-AB0E-4E8A-8294-2D3D230CDF9B", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update2c:*:*:*:*:*:*", "matchCriteriaId": "8EC8BEF1-7908-46C0-841A-834778D1A863", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update2d:*:*:*:*:*:*", "matchCriteriaId": "89D5A7F9-3183-4EE7-828C-13BB9169E199", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update2e:*:*:*:*:*:*", "matchCriteriaId": "9EB94E5F-9AFB-471C-887C-4C53B5169347", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update3:*:*:*:*:*:*", "matchCriteriaId": "D8C5E404-9A83-472C-AE97-25DAE332C327", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update3a:*:*:*:*:*:*", "matchCriteriaId": "78312C9E-4653-4C79-9886-A7A63DB98262", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update3b:*:*:*:*:*:*", "matchCriteriaId": "722B1899-0229-4BEA-94C4-1E475406E7AF", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update3c:*:*:*:*:*:*", "matchCriteriaId": "E1EA338E-4263-42A9-8E91-C3D91A7F8AD1", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update3d:*:*:*:*:*:*", "matchCriteriaId": "3EFDF451-E83B-4340-BF06-AA017B042841", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update3e:*:*:*:*:*:*", "matchCriteriaId": "20D28DF8-BAD2-4613-9325-A55B06FB1F21", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update3g:*:*:*:*:*:*", "matchCriteriaId": "FF925343-3889-46EC-87C5-82B8C3DC33ED", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update3h:*:*:*:*:*:*", "matchCriteriaId": "D9BD9CEF-D37E-45AF-883F-120C32849E14", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update3i:*:*:*:*:*:*", "matchCriteriaId": "1D402845-1C50-40CE-BAA2-CDD5615B660D", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update3j:*:*:*:*:*:*", "matchCriteriaId": "9552133F-9C74-4368-857A-BAFA182BE8EA", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:a:vmware:telco_cloud_infrastructure:3.0:*:*:*:*:*:*:*", "matchCriteriaId": "D11103A7-6AB5-4E78-BE11-BC2A04A09F19", "vulnerable": false}, {"criteria": "cpe:2.3:a:vmware:telco_cloud_platform:*:*:*:*:*:*:*:*", "matchCriteriaId": "320FDFEE-22D1-4650-B177-BF7B1E750D45", "versionEndIncluding": "5.2", "versionStartIncluding": "3.0", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vmware:vcenter_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "45C693CF-0995-4332-9B1E-018EBCDAF83A", "versionEndExcluding": "9.0.2.0100", "versionStartIncluding": "9.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:vcenter_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "C014E906-B622-424E-BFF9-660187C73C54", "versionEndExcluding": "9.1.0.0300", "versionStartIncluding": "9.1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:a:vmware:cloud_foundation:-:*:*:*:*:*:*:*", "matchCriteriaId": "31A7BB38-3238-413E-9736-F1A165D40867", "vulnerable": false}, {"criteria": "cpe:2.3:a:vmware:vsphere_foundation:-:*:*:*:*:*:*:*", "matchCriteriaId": "03AD0AB7-45A3-4DC7-923D-1166346EEA12", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service.\u00a0A malicious actor with network access to vCenter\u00a0may exploit this issue to bypass authentication and gain unauthorized access to the system."}], "id": "CVE-2026-59309", "lastModified": "2026-08-25T18:12:14.410", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security@vmware.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59309", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-30T15:07:53.144480Z", "version": "2.0.3"}}]}, "published": "2026-07-30T13:16:53.870", "references": [{"source": "security@vmware.com", "tags": ["Vendor Advisory"], "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017"}], "sourceIdentifier": "security@vmware.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-303"}], "source": "security@vmware.com", "type": "Secondary"}]}

{}