CVE-2026-59309: vCenter authentication-bypass vulnerability | Rafael Pfister

Analysis on rafaelpfister.ch

Article · October 29, 2026 VMware ESX and Linux Kernel: CISA Reports Attacks on CVE-2026-41709 and Fragnesia On October 28, 2026, CISA added two vulnerabilities to its KEV catalog: CVE-2026-41709 in VMware ESX (operations without log entries, CVSS 2.7) and CVE-2026-46300 (Fragnesia) in the Linux kernel (privilege escalation, CVSS 7.8). Both have been used in real-world attack chains. Updates have been available for months.

Vendor description

VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized access to the system.

Reference data

Vendor

VMware

Affected products

Cloud Foundation
vSphere Foundation
vCenter
Telco Cloud Infrastructure
Telco Cloud Platform

CVSS 3.1

9.8 (CRITICAL)

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness type

CWE-303: Incorrect implementation of authentication algorithm

Published

July 30, 2026

Official sources

← All vulnerabilities