Skip to content

Critical VMware vCenter RCE (CVE-2026-59310) Actively Exploited in the Wild

A critical remote code execution (RCE) vulnerability in VMware vCenter, tracked as CVE-2026-59310 (CVSS score of 9.8), is being actively exploited in the wild by advanced persistent threat (APT) actors. The flaw, a directory traversal issue within the Syslog server component, allows malicious actors with network access to vCenter to execute arbitrary code and establish persistent access using tools like reverse_ssh. Rapid incident response company Quirso first reported the active exploitation, observing over 360 victim IP addresses across 47 countries.

Vulnerability Details: CVE-2026-59310

CVE-2026-59310 is described as a directory traversal vulnerability in the Syslog server functionality of VMware vCenter. Directory traversal (also known as path traversal) attacks allow an attacker to read arbitrary files on the server that are outside the intended directory by manipulating file paths with sequences like ../ (dot-dot-slash). In this critical instance, the vulnerability escalates to arbitrary code execution.

Root Cause: The Syslog server component of vCenter fails to properly sanitize user-supplied input when constructing file paths for log storage or processing. This allows an attacker to inject directory traversal sequences, redirecting file operations to unintended locations on the server.

Exploitation Flow: 1. A malicious actor gains network access to the vCenter server. 2. By sending specially crafted requests to the Syslog server, the attacker exploits the directory traversal vulnerability. 3. This manipulation leads to the execution of arbitrary code on the vCenter server. 4. Following initial code execution, APT actors have been observed deploying persistence mechanisms, specifically using the open-source SSH reverse shell framework reverse_ssh. This establishes an outbound control connection, bypassing typical inbound firewall rules.

Active Exploitation and Impact

The vulnerability was initially disclosed by Broadcom on July 29, 2026, as part of a batch of patches for multiple VMware products. However, active exploitation was detected almost immediately, with Quirso reporting that attacks began on August 3, just five days after disclosure. By August 5, over 340 victim IP addresses were observed connecting to the attackers' infrastructure.

The impact of successful exploitation is severe:

  • Full Control of vCenter: Attackers gain complete control over the vCenter server, which manages virtualized environments.
  • Access to Virtual Machines: This can lead to compromise of all virtual machines, hypervisors (ESXi hosts), and underlying infrastructure managed by vCenter.
  • Data Exfiltration: Sensitive data residing in virtualized environments can be exfiltrated.
  • Lateral Movement: Compromise of vCenter provides a launchpad for extensive lateral movement within the broader enterprise network.
  • Business Disruption: Disruption or destruction of virtualized infrastructure.

Quirso's findings indicate a broad targeting, with half of the identified victim IPs distributed across Germany, the US, Turkey, Iran, and France. While specific APT attribution is not publicly confirmed by Quirso, the speed and sophistication of exploitation suggest well-resourced and capable adversaries.

Remediation and Detection

Given the critical nature and active exploitation of CVE-2026-59310, immediate action is paramount for organizations utilizing VMware vCenter.

Immediate Remediation:

  1. Patch Immediately: Apply the official Broadcom (formerly VMware) patches released on July 29, 2026, as soon as possible. Ensure all vCenter deployments are updated to the latest secure versions.
  2. Network Segmentation: Isolate vCenter servers within a highly segmented network zone, limiting network access strictly to necessary administrative interfaces and trusted sources.
  3. Disable Unused Services: Disable any unnecessary services running on vCenter, including Syslog if it is not actively used or if alternative secure logging solutions are in place.

Detection Strategies:

  1. Monitor for reverse_ssh: Quirso has released a generic YARA rule to identify reverse_ssh builds. Implement this rule in your endpoint detection and response (EDR) and security information and event management (SIEM) systems.
    • YARA Rule: https://github.com/QUIRSO/QTRDetectionContent/blob/main/2026-08-10_reverse_ssh_generic.yar
    • Organizations should also look for unauthorized installations of reverse_ssh and unexpected outbound SSH connections from vCenter servers.
  2. Review vCenter Logs: Scrutinize vCenter logs (especially Syslog activity) for anomalous file path manipulations, unusual process creations, or unexpected commands.
  3. Network Monitoring: Monitor network traffic to and from vCenter servers for suspicious activity, particularly outbound connections that might indicate a reverse shell.
  4. Anomaly Detection: Implement behavioral analytics to detect deviations from normal vCenter operating patterns.

The rapid weaponization of CVE-2026-59310 highlights the critical need for prompt patching of disclosed vulnerabilities, especially in foundational infrastructure components like vCenter. Organizations should maintain a proactive security posture to defend against sophisticated APT campaigns.

Comments (0)

Loading comments...