THREAT LEVEL - HIGH
31-07-2026
High Level – Critical vulnerabilities, affecting VMware vCenter, ESXi VMXNET3 and the Cisco FMC software, actively exploited in the wild
Threat Level Description
IthacaLabs has maintained the Threat Level (High) adding a new observation:
An attack is highly likely. Addressing the broad nature of the threat in order to reach an acceptable risk level, requires additional and sustainable protective security measures combined with specific business and geographical vulnerabilities and judgments.
Description
We have observed that critical vulnerabilities, actively exploited in the wild, affecting VMware vCenter, ESXi VMXNET3 and the Cisco Secure Firewall Management Center (FMC) software, are identified.
Successful exploitation of these vulnerabilities could lead to authentication bypass and remote code execution in the VMware vCenter and ESXi VMXNET3, and also establishment of an unauthenticated session as a low-privileged user to the FMC web management interface, providing unauthorized visibility into sensitive data hosted within the management system.
The flaw, tracked as CVE-2026-59309 (CVSS 9.8), is an authentication bypass vulnerability in the VMware vCenter’s VMware Directory Service. A malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized access to the system.
A second identified flaw, tracked as CVE-2026-59310 (CVSS 9.8), is a directory traversal vulnerability in the Syslog server of the VMware vCenter. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.
A third issue, tracked as CVE-2026-47876 (CVSS 9.3), is an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Non VMXNET3 virtual adapters are not affected by this issue.
Furthermore, an actively exploited issue, tracked as CVE-2026-20316, derives from the fact that Cisco Secure Firewall Management Center (FMC) software uses static, build-in username and password combination designated for a low-privileged account embedded natively within the code, rather than dynamically generated or restricted. An attacker with network reachability to the FMC web management interface can use these built-in credentials to bypass the login mechanism entirely without prior authentication.
Our Advisory and Managed Services, including our Security Operations and Technology Resilience lines, can help safeguard your organization against such threats.
Through proactive monitoring, threat detection, and incident response, our services are designed to keep your systems secure, resilient, and prepared for evolving cyber risks. We advise all organizations to remain vigilant and regularly review their cybersecurity postures.
Affected Systems:
- VMware ESX
- VMware vCenter
- VMware Workstation
- VMware Fusion
- VMware Cloud Foundation
- VMware vSphere Foundation
- VMware Telco Cloud Platform
- VMware Telco Cloud Infrastructure
Cisco Secure Firewall Management Center (FMC) software Vulnerable Configurations. Versions:
- 7.0 Branch
- 7.2 Branch
- 7.4 Branch
- 7.6 Branch
- 7.7 Branch
- 10.0 Branch
Recommendation(s):
You should immediately proceed and install the latest patched versions of VMWare & Cisco Secure Firewall Management Center (FMC) software provided by the vendors.
As far as the VMWare issues are concerned, addition to applying updates, organizations should:
- Prioritize remediation of Internet-facing or externally accessible vCenter instances.
- Restrict network access to VMware management interfaces using firewalls, VPNs, and administrative access controls.
- Monitor vCenter and ESXi logs for indicators of unauthorized access or suspicious administrative activity.
- Verify that all VMware Cloud Foundation and vSphere Foundation components are updated to the versions specified in the advisory.
- Continue following VMware security best practices, including least-privilege administration, multi-factor authentication for management interfaces, and continuous vulnerability management.
For the Cisco Secure Firewall Management Center (FMC) software, in order to determine whether this vulnerability may have been exploited, use the cat /var/log/messages | grep license CLI command in expert mode.
The presence of /var/tmp/license.tmp in the log output, as shown below, indicates potential exploitation of this vulnerability on the Cisco Secure FMC device.
expert
admin@firepower:~$ sudo su
Password:
Last login: Thu Jul 23 19:40:57 UTC 2026 on pts/2
root@firepower:/home/admin#
root@firepower:/home/admin# cat /var/log/messages | grep license
Jul 23 16:16:33 firepower sudo: www : PWD=/ ; USER=root ;
COMMAND=/usr/local/sf/bin/package_info.pl /var/tmp/license.tmp –lsm
You should understand the importance of applying security updates with urgency, regardless of organizational size. Implementing an effective patch management strategy, enabling comprehensive event logging, and actively monitoring security events are critical to protecting business-critical assets. A comprehensive risk management approach should include regular penetration testing, at least annually and after significant system changes, to ensure continued compliance with security best practices and industry regulations.
Threat Level Description:
Threat Level: High – An attack is highly likely. Addressing the broad nature of the threat in order to reach an acceptable risk level, requires additional and sustainable protective security measures combined with specific business and geographical vulnerabilities and judgments.
References:
Three Critical VMware Flaws Allow Auth Bypass, Code Execution, and VM Escape
Cisco Secure Firewall Management Center Software Static Credential Vulnerability
