---
title: VMware vCenter CVE-2026-59310 on CISA KEV since Aug 18 (known ransomware use) | ctxsec
url: https://ctxsec.com/items/vcenter-kev
description: ""
status: "confirmed"
published: 2026-10-13
---

> 

[← Cybersecurity News](/news) · [markdown](/items/vcenter-kev.md)

confirmed

2026-10-13

### VMware vCenter CVE-2026-59310 on CISA KEV since Aug 18 (known ransomware use)

Broadcom VMware vCenter path traversal that lets a network-adjacent attacker execute code. CISA added it to KEV on Aug 18 with an Aug 21 federal due date and marks known ransomware campaign use. A separate dark-web monitor also claimed an exploit for sale (~$10k) on Oct 13; treat that as secondary noise. Patch vCenter and keep it off the public internet.

Sources: [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) · [Broadcom advisory](https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017) · [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-59310) · [@ptdbugs (sale claim)](https://x.com/ptdbugs/status/2109657410138693679)