CVE-2026-59309 CRITICAL

CVE-2026-59309: vCenter authentication-bypass vulnerability

Vendor Vmware
Product Cloud Foundation
Weakness CWE-303
Published July 30, 2026
Last update July 30, 2026

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized access to the system.

Key dates

02Disclosure timeline

July 30, 2026 CVE published
July 30, 2026 Record updated