CVE-2026-59309 is an authentication bypass vulnerability in VMware vCenter's Directory Service within VMware Cloud Foundation. A remote attacker with network access can exploit this flaw to bypass authentication controls, potentially gaining unauthorized administrative access. The vulnerability is categorized under CWE-303, indicating an incorrect implementation of an authentication algorithm. Affected versions include 5.x, 9.0.x.x, and 9.1.x.x of VMware Cloud Foundation. The CVSS v3.1 base score is 9.8, reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official fix information is currently available from the vendor or advisory sources.

Successful exploitation allows an unauthenticated attacker with network access to bypass authentication mechanisms in VMware vCenter, leading to unauthorized full system access. This compromises confidentiality, integrity, and availability of the affected system, potentially allowing control over the VMware Cloud Foundation environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to VMware vCenter services to trusted administrators only and monitor for unusual access attempts. Follow VMware's official security advisories for updates on patches or mitigations.