CISA Adds VMware Vulnerability to KEV Catalog – 8-18-26

Today, CISA announced that it had added a path traversal vulnerability in the VMware vCenter (multiple VMware products are affected by the vulnerability) product to their Known Exploited Vulnerabilities (KEV) catalog. Broadcom previously disclosed the vulnerability and updated their advisory on August 3rd, 2026; they provide additional information here. The vulnerability was reported to Broadcom by Phil Brass and Matt South of Atredis Partners. Two separate Medium articles have reported public exploitation of the vulnerability:  

• Active exploitation of CVE-2026–59310: 361 victim IPs across 47 countries, and  
• Global Exploitation of CVE-2026–59310 by Suspected Chinese-Nexus APT & Related CVE-2026–59309 Activity, 

CISA has directed federal agencies to apply “mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.” 

A compliance deadline of August 21st, 2026, has been established. 

Review - Public ICS Disclosures – Week of 6-6-26 – Part 3

For Part 3 we have three additional vendor disclosures from Genetec (2) and VMware. There are bulk vendor updates from HP (5) and Siemens (10). There are four additional vendor updates from ABB, FortiGuard, Mitsubishi, and Moxa. We also have three researcher reports for vulnerabilities in products from Trane, Vertiv, and Splunk. Finally, we have four exploits for products from Palo Alto Networks (2), FortiGuard, and WatchGuard. 

Advisories  

Genetec Advisory #1 - Genetec published an advisory that describes an incorrect permission assignment for critical resource vulnerability in Genetec product installations deploying RabbitMQ. 

Genetec Advisory #2 - Genetec published an advisory that describes an insertion of sensitive information into a log file vulnerability in their Security Center main server installations. 

VMware Advisory - Broadcom published an advisory that describes three cross-site scripting vulnerabilities in the VMware Cloud Foundation Operations product. 

Bulk Vendor Updates  

HP (5) 

Siemens (10) 

Updates  

ABB Update - ABB published an update for their Freelance Security Lock advisory that was originally published on November 9th, 2025. 

FortiGuard Update - FortiGuard published an update for their Sensitive 2FA Information advisory that was originally published on October 14th, 2025. 

Mitsubishi Update - Mitsubishi published an update for their Realtek Chips advisory that was originally published on March 24th, 2026. 

Moxa Update - Moxa published an update for their Diffie-Hellman Key Exchange Protocol advisory that was originally published on June 2nd, 2025. 

Researcher Reports  

Trane Report - Claroty published a report that describes five vulnerabilities in the Trane Tracer SC+ HVAC controller. 

Vertiv Report - Claroty published a report that describes two vulnerabilities in the Vertiv’s Liebert IS-UNITY-DP network cards. 

Splunk Report - WatchTowr published a report that describes a missing authentication for critical function vulnerability in the PostgreSQL Sidecar Service Endpoint in Splunk Enterprise. 

Exploits  

Palo Alto Networks Exploit #1 - Indoushka published a Metasploit module for a reliance on cookies without validation and integrity checking vulnerability in the PAN GlobalProtect product. 

Palo Alto Networks Exploit #2 - Gray Xploit published an exploit for a reliance on cookies without validation and integrity checking vulnerability in the PAN GlobalProtect product. 

FortiGuard Exploit - Indoushka published a Metasploit module for an OS command injection vulnerability in the FortiGuard FortiSandbox product. 

WatchGuard Exploit - Cody Sixteen published an exploit for a logic error vulnerability in the WatchGuard Firebox product. 

For additional information on these disclosures, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-6-81a - subscription required. 

Review - Public ICS Disclosures – Week of 5-9-26 – Part 2

 For Part 2 we have six additional vendor disclosures from Dell, Supermicro (3), VMware, and Westermo. There are 24 bulk vendor updates for products from ELECOM (6), Schneider (7), and Siemens (11). Finally, we have two exploits for products from OpenPLC and strongSwan. 

Advisories  

Dell Advisory - Dell published an advisory that discusses three vulnerabilities (all listed in CISA’s KEV catalog) in their ThinOS products. 

Supermicro Advisory #1 - Supermicro published an advisory that discusses a microarchitectural predictor vulnerability in multiple Supermicro products. 

Supermicro Advisory #2 - Supermicro published an advisory that discusses three vulnerabilities in multiple Supermicro products. 

Supermicro Advisory #3 - Supermicro published an advisory that discusses an improper initialization vulnerability in multiple Supermicro products. 

VMware Advisory - Broadcom published an advisory that describes a TOCTOU race condition vulnerability in the VMware Fusion product. 

Westermo Advisory - Westermo published an advisory that discusses an out-of-bounds read vulnerability in their Merlin and Virtual Access GW Series OSPF products. 

Updates  

Bulk Vendor Updates – ELECOM (6) 

Bulk Vendor Updates – Schneider (7) 

Bulk Vendor Updates – Siemens (11) 

Exploits  

OpenPLC Exploit - Unicorn-hyh published an exploit for a path traversal vulnerability in OpenPLC-v3. 

StrongSwan Exploit - Indoushka published a Metasploit module for an integer underflow vulnerability in the strongSwan EAP-TTLS implementation. 

For more information on these disclosures, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-5-6f8 - subscription required.