Broadcom VMware vCenter Path Traversal (CVE-2026-59310)

let traversalPatterns = dynamic(["../", "..%2f", "..%2F", "%2e%2e%2f", "%2e%2e/", "..\\", "..%5c", "%252e%252e", "....//", "/etc/passwd", "vpxd.cfg", "data/vsphere-ui", "sms/security", "sso/"]);
let vcenterHosts = dynamic([]);
W3CIISLog
| where csUriStem has_any ("/ui/", "/sdk", "/vsphere-client", "/analytics", "/websso", "/eam", "/sms")
| extend fullUri = strcat(csUriStem, "?", coalesce(csUriQuery, ""))
| where fullUri has_any (traversalPatterns)
| where scStatus in ("200", "206", "301", "302")
| project TimeGenerated, cIP, csMethod, csUriStem, csUriQuery, scStatus, csUserAgent, sSiteName, Computer
| sort by TimeGenerated desc

index=web (sourcetype="ms:iis:auto" OR sourcetype="vcenter:httpd:access" OR sourcetype="nginx:access") uri="*/ui/*" OR uri="*/sdk*" OR uri="*vsphere-client*" OR uri="*/websso*" OR uri="*/analytics*"
| eval decoded_uri=urldecode(uri)
| where match(decoded_uri, "(?i)(\.\./|\.\.\\|/etc/passwd|vpxd\.cfg|%2e%2e|\.\.%2f|\.\.%5c|sms/security|data/vsphere-ui)")
| where status IN ("200","206","301","302")
| stats count min(_time) as firstSeen max(_time) as lastSeen values(uri) as uris values(status) as statuses by src_ip host http_user_agent
| where count > 0
| sort - lastSeen

any where event.category == "web" and
  (url.path : ("*/ui/*", "*/sdk*", "*vsphere-client*", "*/websso*", "*/analytics*", "*/sms*")) and
  (url.original : ("*../*", "*..%2f*", "*..%2F*", "*%2e%2e*", "*..%5c*", "*/etc/passwd*", "*vpxd.cfg*", "*....//*")) and
  http.response.status_code in (200, 206, 301, 302)

SELECT sourceip, destinationip, "URL", "HTTP Response Code", "User Agent", QIDNAME(qid) AS eventName, dateformat(devicetime,'yyyy-MM-dd HH:mm:ss') AS eventTime FROM events WHERE LOGSOURCETYPENAME(devicetype) IN ('Microsoft IIS','Apache HTTP Server','VMware vCenter') AND ("URL" ILIKE '%/ui/%' OR "URL" ILIKE '%/sdk%' OR "URL" ILIKE '%vsphere-client%' OR "URL" ILIKE '%/websso%') AND ("URL" ILIKE '%../%' OR "URL" ILIKE '%..%2f%' OR "URL" ILIKE '%25%2e%2e%' OR "URL" ILIKE '%/etc/passwd%' OR "URL" ILIKE '%vpxd.cfg%' OR "URL" ILIKE '%..%5c%') AND "HTTP Response Code" IN ('200','206','301','302') ORDER BY eventTime DESC LAST 24 HOURS

_sourceCategory=*vcenter* OR _sourceCategory=*iis* OR _sourceCategory=*web/proxy*
| parse regex "(?<method>\S+)\s(?<url>\S+)\s" nodrop
| where url matches /.*(\/ui\/|\/sdk|vsphere-client|\/websso|\/analytics).*/
| where url matches /(?i).*(\.\.\/|\.\.%2f|%2e%2e|\.\.%5c|\/etc\/passwd|vpxd\.cfg|\.\.\.\.\/\/).*/
| where status_code in ("200","206","301","302")
| count by src_ip, url, status_code, http_user_agent
| sort by _count desc

rule vcenter_path_traversal_cve_2026_59310 {
  meta:
    author = "Argus"
    description = "Detects VMware vCenter path traversal exploitation (CVE-2026-59310)"
    severity = "CRITICAL"
    cve = "CVE-2026-59310"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    re.regex($e.network.http.request.url, `(?i).*(/ui/|/sdk|vsphere-client|/websso|/analytics).*`)
    re.regex($e.network.http.request.url, `(?i).*(\.\./|\.\.%2f|%2e%2e|\.\.%5c|/etc/passwd|vpxd\.cfg|\.\.\.\./).*`)
    $e.network.http.response_code = 200 or $e.network.http.response_code = 206 or $e.network.http.response_code = 301 or $e.network.http.response_code = 302
    $ip = $e.principal.ip
  match:
    $ip over 5m
  condition:
    $e
}

#event_simpleName=/HttpRequest|WebRequest/ | (RequestUrl=/(?i)(\/ui\/|\/sdk|vsphere-client|\/websso|\/analytics)/) | RequestUrl=/(?i)(\.\.\/|\.\.%2f|%2e%2e|\.\.%5c|\/etc\/passwd|vpxd\.cfg|\.\.\.\.\/)/ | in(ResponseCode, values=["200","206","301","302"]) | groupBy([RemoteAddressIP4, RequestUrl, ResponseCode], function=count()) | sort(field=_count, order=desc)