VMware vCenter Flaw CVE-2026-59310 Exploited for Persistent Access

CVE-2026-59310 is a directory-traversal vulnerability in the Syslog server component of VMware vCenter, Broadcom's centralized management console for vSphere virtual infrastructure. An attacker with network access to a vulnerable appliance can exploit the flaw without authentication to execute arbitrary code, according to VMSA-2026-0006, published by Broadcom on July 29, 2026. QUIRSO, a German digital forensics and incident response firm, said it uncovered the exploitation while working an incident response engagement and later confirmed a broader pattern across dozens of countries.

After gaining code execution, the attacker installs a malicious cron job on the vCenter host to run reverse_ssh, an open-source Go-based reverse-shell framework, on a recurring schedule. This gives the intruder a durable, self-reestablishing channel back into the environment rather than a one-time foothold.

QUIRSO's telemetry shows compromised systems first reaching out to attacker infrastructure just five days after Broadcom's public disclosure and patch release. QUIRSO said this close correlation suggests the disclosure itself, rather than earlier undisclosed knowledge, marked the starting point of the campaign, though it noted the attacker might have had prior awareness of the flaw. The compressed window between patch and mass exploitation leaves defenders with very little margin to apply updates before automated or targeted scanning finds exposed appliances.

Rapid7 had earlier noted that vCenter Server has appeared on CISA's Known Exploited Vulnerabilities list ten times for prior flaws, underscoring that the product is a recurring target for attackers seeking control over virtualized infrastructure.

• 361 unique victim IP addresses identified across 47 countries.
• Germany leads with 55 unique IPs, followed by the United States (41), Turkey (38), Iran (26), and France (25).
• 151 new victim IPs appeared in a single day on August 4, and 343 of the 361 total were compromised by August 5.

Affected products include vCenter Server 9.1, 9.0, and 8.0, along with VMware Cloud Foundation and vSphere Foundation deployments that bundle vCenter. Organizations exposing vCenter management interfaces directly to the internet face the highest risk, but QUIRSO and Rapid7 both note that internal network access is sufficient for exploitation, so unsegmented internal networks are also exposed.

reverse_ssh is a dual-use, open-source tool that initiates outbound SSH connections from the compromised host to infrastructure controlled by the attacker, rather than waiting for inbound connections. Cyber Security News reported that the tool provides automated connect-backs, local and remote port forwarding for lateral movement, and built-in SCP/SFTP support for staging or exfiltrating virtual machine files. Because the connection is outbound and typically uses standard ports, it routinely evades inbound perimeter firewall rules designed to block unsolicited external access.

Broadcom confirmed there are no workarounds or temporary mitigations for CVE-2026-59310, making the vendor-supplied patch the only remediation. Fixed releases are vCenter 9.1.0.0300, vCenter 9.0.2.0100, and vCenter 8.0 U3k or 8.0 U2f depending on branch, with a separate async patch path to 8.0 U3k for VMware Cloud Foundation 5.x deployments.

1. Apply the patched vCenter build matching your deployed version without delay.
2. Remove vCenter management interfaces from direct internet exposure and require VPN access with multi-factor authentication.
3. Deploy QUIRSO's published generic YARA rule to scan for reverse_ssh client binaries on vCenter hosts and temporary directories.
4. Audit egress logs for unusual, persistent outbound SSH sessions originating from vCenter management IP addresses.

Separately from the CVE-2026-59310 campaign, threat-hunting group Defused Cyber reported a spike in scanning activity consistent with attempts to identify systems vulnerable to CVE-2026-59309, an unauthenticated authentication-bypass flaw in vCenter's Directory Service (vmdir), also rated CVSS 9.8 under VMSA-2026-0006. Honeypot telemetry showed increased version-fingerprinting probes against the vCenter API and walks of the SAML single sign-on flow.

QUIRSO co-founder Denis Szadkowski told The Hacker News there is not yet enough evidence to link the CVE-2026-59309 scanning with the CVE-2026-59310 intrusion set or infrastructure, but said forensic evidence from the incidents it investigated strongly points to CVE-2026-59310 as the confirmed initial access vector behind the reverse_ssh compromises. QUIRSO said it plans a follow-up report detailing the attacker's infrastructure and post-exploitation techniques.