CVE-2026-59309
🗓️ 30 Jul 2026 12:19:52Reported by vmwareType 
cve🔗 web.nvd.nist.gov📰️ 6 Media mentions👁 933 Views🌐 WEB
| Reporter | Title | Published | Views | Family All 22 |
|---|---|---|---|---|
 | Exploit for Incorrect Implementation of Authentication Algorithm in Vmware Vcenter_Server | 1 Oct 202601:29 | – | githubexploit |
 | CVE-2026-59309 | 30 Jul 202612:19 | – | attackerkb |
 | VMware Directory Service Unauthorized Access | 10 Aug 202600:00 | – | bdu_fstec |
 | Security Bulletin: Due to use of VMware ESXi and vCenter, IBM Cloud Pak System is affected by multiple vulnerabilities. | 1 Oct 202609:03 | – | ibm |
 | CVE-2026-59309 | 29 Jul 202610:28 | – | circl |
 | CVE-2026-59309 vCenter authentication-bypass vulnerability | 30 Jul 202612:19 | – | cvelist |
 | EUVD-2026-51098 | 30 Jul 202612:19 | – | euvd |
 | CVE-2026-59310 | 12 Oct 202616:42 | – | kitploit |
 | Vulnerabilities present in VMware products | 29 Jul 202613:29 | – | ncsc |
 | CVE-2026-59309 | 30 Jul 202613:16 | – | nvd |
10
Node
AND
OR
OR
Node
AND
OR
OR
[
{
"vendor": "VMware",
"product": "Cloud Foundation",
"versions": [
{
"status": "affected",
"version": "9.1.x.x"
},
{
"status": "affected",
"version": "9.0.x.x"
},
{
"status": "affected",
"version": "5.x"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "VMware",
"product": "vSphere Foundation",
"versions": [
{
"status": "affected",
"version": "9.1.x.x"
},
{
"status": "affected",
"version": "9.0.x.x"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "VMware",
"product": "vCenter",
"versions": [
{
"status": "affected",
"version": "9.1.x.x",
"lessThan": "9.1.0.0300",
"versionType": "custom"
},
{
"status": "affected",
"version": "9.0.x.x",
"lessThan": "9.0.2.0100",
"versionType": "custom"
},
{
"status": "affected",
"version": "8.0",
"lessThan": "8.0 U3k",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "VMware",
"product": "Telco Cloud Infrastructure",
"versions": [
{
"status": "affected",
"version": "3.0"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "VMware",
"product": "Telco Cloud Platform",
"versions": [
{
"status": "affected",
"version": "5.1.x"
},
{
"status": "affected",
"version": "5.0.x"
},
{
"status": "affected",
"version": "4.x"
},
{
"status": "affected",
"version": "3.0"
}
],
"defaultStatus": "unaffected"
}
]| Parameter | Position | Path | Description | CWE |
|---|---|---|---|---|
| username | request body | /ui | CVE-2026-59309: LDAP SRP authentication bypass allows unauthorized access and potential creation of SSO administrators; after bypass, login to /ui can lead to webshell/Statsreport deployment | CWE-303 |
| password | request body | /ui | CVE-2026-59309: LDAP SRP authentication bypass allows unauthorized access and potential creation of SSO administrators; after bypass, login to /ui can lead to webshell/Statsreport deployment | CWE-303 |
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
25 Aug 2026 18:12Current
8.9High risk
Vulners AI Score8.9
CVSS 3.19.8
EPSS0.00611
SSVC