Our automated tracking framework flagged that CISA added CVE-2026-59310 (Broadcom VMware vCenter) to the Known Exploited Vulnerabilities (KEV) catalog on August 20, 2026. A KEV listing is CISA’s official confirmation that the flaw is being exploited in the wild — U.S. federal agencies must patch it by a fixed deadline. Here is what our data shows.
What CISA Reported
CISA describes the flaw as follows: “Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code.”
Under Binding Operational Directive rules, U.S. federal agencies must remediate CVE-2026-59310 by August 21, 2026 — a 3-day window. Private organizations are not bound by the deadline, but CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.
The Details
| CVE | CVE-2026-59310 |
| Vendor / product | Broadcom VMware vCenter |
| Vulnerability | Broadcom VMware vCenter Path Traversal Vulnerability |
| CVSS base score | 9.8 |
| Added to KEV | August 18, 2026 |
| Days public before listing (NVD → KEV lag) | 19 |
| Federal patch deadline | August 21, 2026 |
| Known ransomware use | No |
How This Compares to Broadcom’s Track Record
This one was public for 19 days before CISA confirmed exploitation — longer than Broadcom’s 19-day median, a vulnerability that sat exploitable in the open.
| Broadcom in the CISA KEV catalog | Value |
|---|---|
| Tracked KEV entries | 5 |
| Median lag (public → KEV listing) | 19 days |
| 0-day rate (exploited at or before disclosure) | 0% |
| Entries tied to known ransomware campaigns | 0 |
For perspective, the median across all 1671 tracked KEV entries is 267 days — Broadcom’s exploited vulnerabilities are flagged faster than the catalog average.
Other Recent Broadcom KEV Additions
The most recent Broadcom vulnerabilities CISA has confirmed as actively exploited, from our tracker:
| CVE | Product | Added to KEV | Lag (days) | Ransomware |
|---|---|---|---|---|
| CVE-2026-22719 | VMware Aria Operations | March 3, 2026 | 6 | No |
| CVE-2024-37079 | VMware vCenter Server | January 23, 2026 | 584 | No |
| CVE-2025-41244 | VMware Aria Operations and VMware Tools | October 30, 2025 | 31 | No |
| CVE-2025-1976 | Brocade Fabric OS | April 28, 2025 | 4 | No |
What This Means for Defenders
CISA has added CVE-2026-59310, a critical path traversal vulnerability in Broadcom VMware vCenter, to its Known Exploited Vulnerabilities (KEV) catalog. This flaw has a CVSS base score of 9.8. The federal patch deadline is August 21, 2026, just three days after its KEV inclusion, which means federal agencies must patch it immediately. All organizations using Broadcom VMware vCenter should prioritize patching within this narrow window.
The vulnerability was public for 19 days before its KEV listing. While no known ransomware use is reported for CVE-2026-59310, its critical nature makes it a prime target for threat actors. Organizations unable to apply the patch before the August 21 deadline must implement strong compensating controls. Isolate vCenter instances from public exposure, enforce strict network segmentation, and enhance monitoring for anomalous activity originating from or targeting vCenter servers. Review logs for suspicious access attempts or unauthorized file modifications. Immediate patching remains the primary and most effective remediation.
Related Coverage
- Critical Microsoft SharePoint Flaw CVE-2026-50522 (CVSS 9.8) Added to CISA KEV (July 2026)
- WordPress’s CVE-2026-63030 Was Exploited in 4 Days — Well Under Its 420-Day Median (July 2026)
How We Track This
This report was generated from our CISA KEV Lag Tracker, which syncs the official CISA KEV catalog daily and records the date each CVE is added. For every entry we retrieve the original NVD publication date and compute the lag in calendar days. No dates or figures on this page are estimated or taken from third-party sources — they come directly from CISA and NVD records.
