VMware vCenter, the central console that manages VMware virtual environments, has a critical flaw
(CVE-2026-59310) that lets an attacker on the network run their own code on the server without
logging in. Attackers began exploiting it just five days after VMware’s fix was published, and security
firm QUIRSO has already found 361 compromised systems across 47 countries, with a suspected
nation-state group installing hidden remote-access channels to keep control. There is no workaround,
so any organisation running vCenter, especially if it is reachable from the internet, should apply
VMware’s patch immediately and check for signs of compromise.
1. Vulnerability Details
CVE ID – CVE-2026-59310
CVSS SCORE – 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EXPLOIT STATUS – VMware published VMSA-2026-0006 on 29 July 2026, updated to 0006.1 on 3 August, and rates the flaw Critical. There is no workaround. QUIRSO reports active mass exploitation by a
suspected APT: victims began connecting to attacker infrastructure on 3 August, five days after
disclosure; the campaign peaked on 4 August; and QUIRSO identified 361 victim IP addresses
across 47 countries by 9 August.
CVE-2026-59310 is a directory-traversal vulnerability in the VMware vCenter Syslog server. An unauthenticated attacker with network access to vCenter can abuse it to execute arbitrary code on the appliance. Broadcom rates it Critical with a maximum CVSS score of 9.8 and states there is no workaround, so patching is the only remediation. The same VMSA2026-0006 updates also fix a paired vCenter authentication-bypass flaw, CVE-2026-59309, in the VMware Directory
Service.
2. Affected Products
- VMware vCenter 9.1.x. Fixed in 9.1.0.0300 (the fix first shipped in 9.1.0.0200; 9.1.0.0300 is the latest cumulative release).
- VMware vCenter 9.0.x. Fixed in 9.0.2.0100.
- VMware vCenter 8.0. Fixed in 8.0 U3k or 8.0 U2f, depending on the deployed branch.
- VMware Cloud Foundation vCenter 5.x (async patch to 8.0 U3k) and VMware Telco Cloud Platform and Infrastructure (KB449886). No workaround; apply the update from VMSA-2026-0006.1.
3. Exploitation Campaign
QUIRSO’s threat research team is tracking the campaign from a recent incident-response engagement. The flaw was reported to Broadcom by Phil Brass and Matt South of Atredis Partners.
- Narrow disclosure-to-exploitation window : Exploitation began on 3 August 2026, five days after VMware’s 29 July disclosure, peaked on 4 August with 151 new victim IPs, and reached about 95 per cent of the observed victims by 5 August, suggesting the disclosure itself kicked off the campaign.
- Global impact : QUIRSO identified 361 victim IP addresses across 47 countries between 3 and 9 August, led by Germany, the United States, Turkey, Iran, and France.
- reverse_ssh persistence : After compromise, the suspected APT deploys the open-source reverse_ssh tool to hold an outbound control channel that bypasses inbound network controls. QUIRSO is withholding attacker-specific indicators while coordinating with law enforcement.
4. Other Notable CVEs
- CVE-2026-59309 (CVSS 9.8) Paired VMware vCenter authentication-bypass flaw in the VMware Directory Service. A network attacker can bypass authentication and gain unauthorised access. Fixed by the same VMSA-2026-0006.1 updates.
5. Adversary Toolkit
| reverse_ssh | Go (SSH reverse-shell framework) | Open-source, dual-use tool used for outbound connect-back persistence, SSH port forwarding, file transfer, and remote shell on compromised vCenter appliances. |
6. Recommendations
- Identify all VMware vCenter instances and apply the fixed release from VMSA-2026-0006.1 (9.1.0.0300,9.0.2.0100, or 8.0 U3k / 8.0 U2f); there is no workaround.
- Remove vCenter from public internet exposure and restrict management-interface access to trusted administrator networks, since the flaw is exploitable by any network-reachable, unauthenticated attacker.
- Hunt for reverse_ssh persistence on vCenter appliances: alert on any outbound SSH or long-lived encrypted outbound connection initiated by vCenter (which should never dial out over SSH), unauthorised Go-compiled binaries or executables in temporary or non-standard paths, new systemd services, cron jobs, or startup entries that establish an outbound connect-back, and the vCenter Syslog or web service spawning a shell or writing an executable to disk.
- Confirm the same updates also remediate the paired authentication bypass CVE-2026-59309, and review vCenter and VMware Directory Service accounts for unauthorised access.
- If compromise is found, rebuild or forensically review the vCenter appliance, rotate vCenter and single signon credentials and certificates, and check connected ESXi hosts and management systems for lateral movement.
7. Sources
- https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017
- https://github.com/vmware/vcf-security-and-compliance-guidelines/tree/main/security-advisories/vmsa-2026-0006
- https://medium.com/@quirso_de/active-exploitation-of-cve-2026-59310-361-victim-ips-across-47-countries-9783187cc6ff
- https://github.com/QUIRSO/QTRDetectionContent/blob/main/2026-08-10_reverse_ssh_generic.yar
Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn
No related posts found.