Threat actors are actively exploiting CVE-2026-59310, a critical unauthenticated remote code execution vulnerability affecting VMware vCenter Server, with incident responders identifying compromises across dozens of countries.
The vulnerability is a directory traversal flaw in the vCenter Syslog server. Broadcom has assigned it a CVSS v3.1 score of 9.8 and warns that an attacker with network access to a vulnerable vCenter instance can exploit the issue to execute arbitrary code. No authentication or user interaction is required.
Vulnerability Overview
CVE-2026-59310 affects the Syslog server component of VMware vCenter Server.
The flaw is classified as CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly referred to as directory or path traversal. A malicious actor with network access to vCenter can use the vulnerability to execute arbitrary code.
While directory traversal vulnerabilities are often associated with unauthorized file access, the implementation affected by CVE-2026-59310 has considerably more severe consequences.
Manipulation of the way vCenter processes and records Syslog messages can allow an unauthenticated network attacker to plant a malicious file on the appliance and cause it to execute automatically as root.
This effectively turns the path traversal primitive into unauthenticated root-level remote code execution.
Exploitation Began Days After Disclosure
Broadcom published VMSA-2026-0006 on July 29, 2026, addressing CVE-2026-59310 alongside several additional VMware vulnerabilities.
By August 3, compromised systems were communicating with infrastructure controlled by the threat actor, with the campaign expanding rapidly over the following days.
Observed Attack Chain
Some of the observed threat actor activity followed the following attack chain:
1. Initial Access Through CVE-2026-59310
The attacker targets a vulnerable and network-reachable VMware vCenter appliance, using CVE-2026-59310 as an initial access vector.
2. Persistence Through Cron
Following compromise, the attacker creates a malicious cron job on the vCenter appliance.
Scheduled jobs provide a straightforward mechanism for repeatedly executing attacker-controlled commands after initial compromise.
3. Deployment of reverse_ssh
The cron-based persistence mechanism was used with the open-source reverse_ssh framework.
Rather than requiring the attacker to establish a new inbound connection to the compromised appliance, reverse SSH causes the infected system to initiate an outbound connection toward attacker-controlled infrastructure.
4. Persistent Remote Access
The resulting connection provides the attacker with a durable command-and-control path into the compromised environment.
Because the connection is initiated outbound, reverse SSH can potentially bypass controls primarily designed to block unsolicited inbound administrative access.
Critically, this persistence is independent of CVE-2026-59310 once installed.
As a result, applying the VMware patch after compromise does not necessarily remove the attacker’s access. QUIRSO specifically warned that reverse-SSH persistence can survive an update to a fixed vCenter release.
reverse_ssh Is Not Malicious by Itself
reverse_ssh is a legitimate open-source tool and its presence alone should not automatically be treated as evidence of compromise.
CVE-2026-59309 Is Also Worth Monitoring
CVE-2026-59310 was disclosed alongside CVE-2026-59309, another critical vCenter vulnerability carrying a CVSS score of 9.8.
CVE-2026-59309 affects VMware Directory Service and allows a malicious actor with network access to bypass authentication and gain unauthorized access to vCenter.
Security researchers have separately observed increased scanning consistent with reconnaissance for CVE-2026-59309, including:
POST /sdk/
requests involving RetrieveServiceContent, as well as activity targeting the /websso SAML SSO flow.
However, defenders should not currently assume that CVE-2026-59309 is being chained with CVE-2026-59310 in the observed campaign.
QUIRSO stated that it does not have sufficient evidence to correlate CVE-2026-59309 scanning with the threat actor or infrastructure involved in the CVE-2026-59310 compromises.
Affected and Fixed Versions
Broadcom lists the following patched releases for CVE-2026-59310:
| Product / Branch | Fixed Version |
| VMware Cloud Foundation / vSphere Foundation vCenter 9.1.x | 9.1.0.0300 |
| VMware Cloud Foundation / vSphere Foundation vCenter 9.0.x | 9.0.2.0100 |
| VMware vCenter 8.0 U3 | 8.0 U3k |
| VMware vCenter 8.0 U2 | 8.0 U2f |
| VMware Cloud Foundation 5.x | Async patch to 8.0 U3k |
| VMware Telco Cloud Platform | Follow Broadcom KB449886 |
| VMware Telco Cloud Infrastructure | Follow Broadcom KB449886 |
Broadcom provides no workaround for CVE-2026-59310. Organizations must install the applicable vendor update.
Recommended Mitigation and Response
1. Patch VMware vCenter Immediately
Update all affected vCenter appliances to the fixed versions identified in VMSA-2026-0006.
Broadcom provides no workaround, making patch installation the primary means of closing the vulnerability.
2. Do Not Treat Patching as Incident Closure
If a vulnerable vCenter instance was network-accessible between disclosure and patching, investigate it for evidence of prior compromise.
The observed attackers establish persistence that can remain functional after the vulnerable software itself has been updated.
3. Hunt for Persistence and Unexpected Outbound Connections
Review cron configuration, recently created files, running processes and outbound network connections.
Prioritize unexplained SSH sessions and connectivity from vCenter toward unfamiliar external infrastructure.
4. Restrict Access to the vCenter Management Plane
vCenter should not be unnecessarily exposed to the public internet.
Restrict administrative and service access to dedicated management networks, approved jump hosts and trusted administrator endpoints.
Network segmentation does not replace patching, but it significantly reduces the number of systems capable of reaching a vulnerable management service.
Stay Safe. Stay Secure.
OP Innovate Research Team
