Broadcom Releases Critical Security Updates for VMware vCenter and ESX Vulnerabilities
Broadcom has released security updates to address multiple vulnerabilities in VMware vCenter and VMware ESX, including issues rated as Critical. The company disclosed the flaws in security advisory VMSA-2026-0006 on July 29, 2026, covering five vulnerabilities reported through private channels.
Two vulnerabilities received the highest severity rating of Critical. CVE-2026-59309 is an authentication bypass flaw in VMware Directory Service that allows attackers to bypass authentication over the network, potentially leading to unauthorized system access.
CVE-2026-59310 is a path traversal vulnerability in Syslog server processing that could permit arbitrary code execution. Both issues affect VMware vCenter as well as products that incorporate the component, including VMware vSphere Foundation, VMware Cloud Foundation, VMware Telco Cloud Platform, and VMware Telco Cloud Infrastructure.
Administrators are strongly advised to apply the available patches immediately to mitigate the risks associated with these critical flaws.
Related articles
Exploiting SSTI Vulnerability in Messenger Machine on Standoff 365 Leads to RCE and Corporate Chat Access
A detailed writeup published by Positive Technologies researcher Seven11eleven demonstrates a full attack chain against the vulnerable Messenger machine on the Standoff 365 platform. The researcher began with network reconnaissance using nmap and directory fuzzing with ffuf, uncovering Swagger documentation and JWT-protected endpoints. After identifying user enumeration through the friend search feature, the team discovered a Server-Side Template Injection flaw in the friendship summary functionality powered by the Mako template engine. The SSTI was escalated to remote code execution by injecting Python expressions that leveraged the self.module.cache.util chain to call os.popen commands. With initial access obtained via reverse shell, the attacker pivoted to neighboring services including Gitness, RabbitMQ, and Redis to achieve the defined business risks of accessing developer corporate messaging and extracting the city messenger encryption key.
SCCM Misconfigurations Expose Organizations to Full Infrastructure Takeover
BI.ZONE expert Alexander Kuznetsov details how Microsoft Configuration Manager (SCCM) deployments in 25% of Russian organizations can grant attackers complete control over corporate infrastructure when misconfigured. The article outlines critical risks including administrative privilege escalation, lateral movement, data collection, persistence, and policy manipulation that allow attackers to blend with legitimate maintenance operations. Key recommendations focus on infrastructure isolation, placing Site Server, SMS Provider, and Site Database Server roles in Tier 0 segments, and avoiding single SCCM hierarchies across multiple Active Directory forests or security tiers. The report emphasizes eliminating Network Access Account (NAA) usage in favor of HTTPS or Enhanced HTTP, strictly limiting Client Push Account and domain join account privileges, and auditing computer accounts for site servers. Additional guidance covers PXE deployment risks, database access restrictions, and role-based administrative controls to prevent credential extraction via tools such as SharpSCCM and mimikatz. Overall, the publication provides actionable hardening steps aligned with the principle of least privilege to reduce the attack surface of widely deployed SCCM environments.
Critical Vulnerability in ASUS Control Center Enterprise Allows Remote Root Access Without Authentication
ASUS has disclosed a severe vulnerability in its terminal management software ASUS Control Center Enterprise (ACC) that could allow unauthenticated remote attackers to obtain root privileges. The issue, tracked as CVE-2026-75754, stems from a combination of hardcoded credentials, missing authentication on critical functions, and server-side request forgery flaws. Attackers can retrieve encryption keys via unauthenticated HTTP requests and then enable SSH on TCP port 2222 using the hardcoded credentials to log in as root. The flaw affects managed devices across an organization, potentially leading to data leakage, tampering, deletion, and full remote control. ASUS released a security advisory on September 4, 2026, and strongly recommends immediate updates. The vulnerability was reported by Security NEXT on September 7, 2026.
Top 10 Security Stories: Critical Flaws in PaperCut NG/MF, Chrome, WatchGuard and Others Dominate Week
Security NEXT has published its weekly ranking of the ten most-read articles between August 30 and September 5 2026. The list is led by a critical vulnerability in PaperCut NG/MF that is already being exploited in the wild. Google Chrome received two separate updates addressing 38 vulnerabilities, including two rated Critical and one zero-day. WatchGuard Fireware OS, SonicWall SMA 1000, Cisco IOS XR and Apache Tomcat also received urgent patches for severe flaws. Three real-world incidents made the top ten: a customer-data breach at 01 Bank, a ransomware infection at Hands HD and a suspected cloud leak at Corona. The ranking reflects strong reader interest in both newly disclosed vulnerabilities and confirmed exploitation cases.