NCSC-2026-0269 [1.01] [M/H] Vulnerabilities fixed in VMware products

unknownCVE-2026-59309 CVE-2026-59310 CVE-2026-47876 CVE-2026-41703 CVE-2026-41709

VMware has fixed vulnerabilities in VMware vCenter and VMware ESX products. VMware vCenter contains a critical authentication-bypass vulnerability in the Directory Service identified by CVE-2026-59309. This vulnerability allows an attacker with network access to VMware vCenter to exploit it to bypass authentication and gain unauthorized access to the system. Additionally, VMware vCenter also contains a critical directory-traversal vulnerability in the Syslog server identified by CVE-2026-59310. This vulnerability may allow an attacker to execute arbitrary code, potentially manipulating file and directory paths and gaining access to files outside the intended Syslog directory. VMware ESX contains a critical out-of-bounds write vulnerability in the VMXNET3 virtual network adapter identified by CVE-2026-47876. This vulnerability allows an attacker with local administrative rights on a virtual machine with a VMXNET3 virtual network adapter to execute code on the underlying host. This enables an attacker to write data outside the intended memory limits, which can lead to memory corruption and unpredictable behavior or compromise of the virtual system. Virtual network adapters that do not use VMXNET3 are not vulnerable. VMware ESX, Workstation, and Fusion also contain an out-of-bounds read vulnerability identified by CVE-2026-41703. Exploitation of this vulnerability may result in unintended access to memory outside the allocated buffer, which can lead to information leaks or system instability within virtual environments. Additionally, VMware ESX contains a vulnerability identified by CVE-2026-41709 due to insufficient logging. A malicious administrator can exploit this vulnerability to perform certain actions that are not recorded in the log files. It is good practice to access

CSIRTS triage

vendor: VMware product: vCenter Authentication bypass Path traversalOther

What: VMware vCenter contains critical vulnerabilities that allow authentication bypass and directory traversal, potentially leading to unauthorized access and arbitrary code execution.
Who is affected: Deployments of VMware vCenter and VMware ESX products are affected.
Urgency: Remediation is urgent due to the critical nature of the vulnerabilities and potential for exploitation.
Action: Apply the latest patches provided by VMware.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch vCenter

Get an email when a new vCenter advisory drops — max one per day, one-click unsubscribe.

Details

Source: NCSC-NL Advisories (NL · national-cert · site)
Severity: unknown
Published: 2026-07-29
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://advisories.ncsc.nl/advisory?id=NCSC-2026-0269

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-593090.74% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 51% of all scored CVEs.
Moderate exploitation riskCVE-2026-593101.1% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 63% of all scored CVEs.
Low exploitation riskCVE-2026-478760.28% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 20% of all scored CVEs.
Low exploitation riskCVE-2026-417030.56% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 43% of all scored CVEs.
Low exploitation riskCVE-2026-417090.38% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 31% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-59309	coverage & exploitation status	NVD · CVE.org
CVE-2026-59310	coverage & exploitation status	NVD · CVE.org
CVE-2026-47876	coverage & exploitation status	NVD · CVE.org
CVE-2026-41703	coverage & exploitation status	NVD · CVE.org
CVE-2026-41709	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

Recent advisories for VMware products

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

high[NEW] [high] VMware Products: Multiple vulnerabilitiescert-bund · 2026-07-31
unknownMultiple Vulnerabilities in VMware Products (July 30, 2026)cert-fr-avis · 2026-07-30
criticalexploitedCVE-2022-22960: VMware Multiple Products Privilege Escalation Vulnerabilitycisa-kev · 2022-04-15
criticalexploitedCVE-2020-4006: Multiple VMware Products Command Injection Vulnerabilitycisa-kev · 2021-11-03
criticalexploitedCVE-2020-3950: VMware Multiple Products Privilege Escalation Vulnerabilitycisa-kev · 2021-11-03