Vulnerability · Published Jul 30, 2026 · Assigned by vmware
CVE-2026-59309vCenter authentication-bypass vulnerability
Critical 9.8
In plain English
A critical-severity security flaw in Cloud Foundation from VMware. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.6%top 50.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized access to the system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| VMware | Cloud Foundation | 9.1.x.x9.0.x.x5.x |
| VMware | vSphere Foundation | 9.1.x.x9.0.x.x |
| VMware | vCenter | 9.1.x.x – before 9.1.0.03009.0.x.x – before 9.0.2.01008.0 – before 8.0 U3k |
| VMware | Telco Cloud Infrastructure | 3.0 |
| VMware | Telco Cloud Platform | 5.1.x5.0.x4.x3.0 |
Weakness: CWE-303 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H