VMware vCenter CVE-2026-59310 Exploited in Global Attacks
Broadcom disclosed CVE-2026-59310 on July 29 in advisory VMSA-2026-0006.1 and patched it alongside four other VMware security defects. The company describes the vulnerability as a directory traversal issue in the vCenter Syslog server that can let a network-based attacker execute arbitrary code. No credentials or user interaction are required under the published CVSS vector, and Broadcom lists no workaround.
Quirso observed exploitation beginning on August 3, four days after public disclosure. SecurityWeek reported that more than 340 victim IP addresses had connected to attacker infrastructure by August 5. Roughly half of the observed addresses were in Germany, the United States, Turkey, Iran and France. Quirso cautioned that an IP address does not necessarily represent a unique organization because cloud, hosting and shared infrastructure can serve multiple customers.
After gaining access, the attackers deployed the open-source reverse_ssh framework, according to Quirso. The tool creates an outbound control connection from the compromised vCenter system, helping the operator maintain access where inbound connections may be blocked. Quirso released a generic YARA rule for reverse_ssh client binaries, but noted that the software also has legitimate penetration-testing uses, so detections require supporting telemetry.
Broadcom has issued patches for supported vCenter branches. Its response matrix lists 9.1.0.0300, 9.0.2.0100, and 8.0 U3k or U2f as fixed releases, with separate instructions for Cloud Foundation and Telco Cloud deployments. Because no workaround is available, administrators should apply the appropriate update and limit vCenter access to trusted management networks rather than exposing the service to the public internet.
Defenders should review vCenter systems for unexpected outbound connections, unauthorized software and reverse_ssh YARA matches, then correlate findings with execution and network logs. Organizations should inventory all vCenter versions, remove unnecessary external exposure and investigate vulnerable systems for activity dating from August 3. Systems showing evidence of compromise should be isolated and handled through the established incident-response process.