Skip to content
COOEY

EXPOSURES › CVE-2026-59270

CVE-2026-59270

CRITICAL
DETAIL
SourceNVD · cve Published2026-08-27 CVSS9.4 Referencehttps://nvd.nist.gov/vuln/detail/CVE-2026-59270 ↗
⚡ RCE SHAME 85/100 default-credsunpatchedexploited-in-wildransomware

VMware vCenter's embedded UnboundID LDAP server unconditionally registers an admin credential and binds to all network interfaces, enabling remote access.

The embedded LDAP server's hardcoded admin credentials and all-interface binding allow unauthenticated attackers to gain persistent remote access, a critical flaw for DIBs relying on VMware infrastructure. This exposes systems to ransomware and data breaches, requiring immediate patching and network segmentation.

Shame score — Hardcoded admin credentials and all-interface binding are avoidable design flaws that enable persistent remote access, representing a severe negligence in secure defaults.

▸ RECOMMENDED ACTION  Remote code execution — patch the affected products on priority.

PLAYERS IMPLICATED
VMware, Inc. · vendorspring security · product
DESCRIPTION

Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18 Spring Security 5.8.0 - 5.8.27 Spring Security 5.7.0 - 5.7.25

AFFECTED FEDRAMP PRODUCTS · 2
PRODUCTSTATUS
VMware Government Services (VGS)
VMware, Inc.
 Authorized
Workspace ONE
VMware, Inc.
 Authorized