Attackers are actively exploiting VMware vCenter vulnerability CVE-2026-59310 to execute code and establish persistent remote access on exposed management servers, according to reports published August 13. SecurityWeek, citing incident response firm Quirso, said the campaign has touched more than 360 victim IP addresses across 47 countries. The flaw carries a 9.8 CVSS score and affects a platform that centrally manages virtualized enterprise infrastructure.

Broadcom disclosed CVE-2026-59310 on July 29 in advisory VMSA-2026-0006.1 and patched it alongside four other VMware security defects. The company describes the vulnerability as a directory traversal issue in the vCenter Syslog server that can let a network-based attacker execute arbitrary code. No credentials or user interaction are required under the published CVSS vector, and Broadcom lists no workaround.

Quirso observed exploitation beginning on August 3, four days after public disclosure. SecurityWeek reported that more than 340 victim IP addresses had connected to attacker infrastructure by August 5. Roughly half of the observed addresses were in Germany, the United States, Turkey, Iran and France. Quirso cautioned that an IP address does not necessarily represent a unique organization because cloud, hosting and shared infrastructure can serve multiple customers.

After gaining access, the attackers deployed the open-source reverse_ssh framework, according to Quirso. The tool creates an outbound control connection from the compromised vCenter system, helping the operator maintain access where inbound connections may be blocked. Quirso released a generic YARA rule for reverse_ssh client binaries, but noted that the software also has legitimate penetration-testing uses, so detections require supporting telemetry.

Broadcom has issued patches for supported vCenter branches. Its response matrix lists 9.1.0.0300, 9.0.2.0100, and 8.0 U3k or U2f as fixed releases, with separate instructions for Cloud Foundation and Telco Cloud deployments. Because no workaround is available, administrators should apply the appropriate update and limit vCenter access to trusted management networks rather than exposing the service to the public internet.

Defenders should review vCenter systems for unexpected outbound connections, unauthorized software and reverse_ssh YARA matches, then correlate findings with execution and network logs. Organizations should inventory all vCenter versions, remove unnecessary external exposure and investigate vulnerable systems for activity dating from August 3. Systems showing evidence of compromise should be isolated and handled through the established incident-response process.