VMware vCenter Under Active Scanning: Why Organizations Should Take the Latest Vulnerabilities Seriously

Published: August 11, 2026

Virtualization infrastructure is once again drawing attention from security researchers and attackers.

Recent security reporting indicates increased scanning activity against VMware vCenter environments following the disclosure of critical vulnerabilities. Researchers monitoring exposed systems have observed activity consistent with attackers identifying potentially vulnerable vCenter installations. This does not, by itself, prove that vulnerable systems have been compromised—but it is an important warning for organizations running VMware infrastructure.

The development follows Broadcom's July 29, 2026 security advisory, VMSA-2026-0006, which addresses multiple vulnerabilities across VMware products. Two of the most significant issues affect VMware vCenter Server and carry a maximum CVSS v3 score of 9.8 (Critical).

What are the VMware vCenter vulnerabilities?

The two critical vCenter vulnerabilities are:

• CVE-2026-59309 — an authentication-bypass vulnerability in VMware Directory Service (vmdir).
• CVE-2026-59310 — a directory-traversal vulnerability in the vCenter Syslog Server.

According to Broadcom, both vulnerabilities can be exploited by an attacker with network access to vCenter. CVE-2026-59309 could allow authentication to be bypassed, while CVE-2026-59310 could potentially lead to arbitrary code execution. Broadcom rates both vulnerabilities at CVSS 9.8 and lists no workaround.

That combination makes these vulnerabilities particularly important: they affect the management layer of a virtualized environment rather than an isolated end-user application.

Why is vCenter such an attractive target?

VMware vCenter Server is used to centrally manage virtual infrastructure.

Depending on an organization's configuration, control of the management platform could provide an attacker with significant visibility into virtual machines, hosts, networks and other infrastructure components.

This means compromising a management system can have consequences well beyond the server initially targeted.

For security teams, the important lesson is simple:

A vulnerability in the virtualization management plane should be treated as an infrastructure-level security concern.

An internet-exposed management interface is especially concerning because attackers can continuously scan for vulnerable systems without needing to know in advance which organization owns them.

Scanning does not mean compromise

Recent reporting from Cyber Security News describes increased scanning and fingerprinting activity against VMware vCenter systems. The reported activity included requests associated with vCenter services and authentication-related paths.

However, there is an important distinction between scanning and successful exploitation.

A scan may indicate that attackers are looking for vulnerable systems, but it does not establish that an organization has been breached.

Security teams should therefore avoid jumping directly from "we saw scanning" to "we were compromised."

Instead, scanning should be treated as a signal to validate exposure, patch affected systems and investigate suspicious activity.

Which versions contain fixes?

Broadcom's advisory provides fixed versions for affected vCenter deployments.

For the two critical vCenter vulnerabilities, the advisory lists:

Broadcom also notes that the fixes are cumulative and provides additional remediation information for VMware Cloud Foundation and Telco Cloud environments. Organizations should consult the official advisory and confirm the appropriate update for their specific deployment before making changes.

What should organizations do now?

Organizations using VMware vCenter should consider the following actions:

1. Identify exposed vCenter systems

Create an accurate inventory of vCenter servers and determine whether any management interfaces are accessible from untrusted networks or the public internet.

2. Check the installed versions

Compare deployed versions against Broadcom's fixed-version information.

Do not assume that a system is protected simply because it was recently updated. Verify the actual running version.

3. Prioritize patching

Because the two vCenter vulnerabilities have a CVSS score of 9.8 and Broadcom lists no workaround, affected organizations should prioritize the applicable security updates.

4. Restrict management-plane exposure

Where possible, vCenter administration interfaces should not be directly exposed to the public internet.

Network segmentation, access controls, VPN or zero-trust access models can reduce the number of systems that can reach sensitive management services.

5. Review authentication and administrative activity

Security teams should review authentication logs and administrative activity for unexpected accounts, unusual access times, unfamiliar source addresses or unexplained configuration changes.

6. Look for signs of unauthorized access

If a vulnerable vCenter was exposed to potentially hostile networks, organizations should investigate rather than relying solely on the assumption that patching resolves the incident.

Patching closes the vulnerability going forward; it does not automatically answer whether the system was accessed before remediation.

The bigger security lesson

The VMware situation highlights a broader cybersecurity principle: critical infrastructure management systems deserve the same security attention as production applications and databases.

Organizations often focus heavily on internet-facing web applications while assuming internal management systems are protected by the network.

That assumption becomes increasingly risky as attackers improve their ability to discover exposed infrastructure automatically.

Virtualization platforms can also provide a valuable target because they sit close to the center of an organization's computing environment.

Final thoughts

The latest VMware vCenter scanning activity should be viewed as an early warning rather than definitive evidence of widespread exploitation.

But organizations should not wait for confirmed exploitation before responding.

The combination of critical vulnerabilities, high-value management infrastructure and evidence of active scanning makes this an appropriate time to verify vCenter exposure, apply the vendor-recommended updates and review security monitoring around the virtualization management plane.

For organizations running VMware environments, knowing exactly which systems are exposed—and whether they are running fixed versions—is one of the most important steps they can take now.

Sources

• Broadcom — VMSA-2026-0006: Official security advisory covering CVE-2026-59309, CVE-2026-59310 and related VMware vulnerabilities.
• Cyber Security News — “Hackers Actively Scanning to Exploit VMware VCenter Vulnerabilities”: Secondary reporting on observed scanning activity.

Ref:https://cybersecuritynews.com/hackers-scan-vmware-vcenter-vulnerabilities/