A critical remote code execution (RCE) vulnerability in VMware vCenter Syslog Server, identified as CVE-2026-59310, is actively being exploited to establish persistent remote access through a reverse SSH tool. Broadcom, the vendor, confirmed the flaw on July 29 and released emergency patches, describing it as a directory traversal vulnerability that allows unauthenticated attackers with network access to execute arbitrary code.
Digital forensics firm QUIRSO has observed compromises at 361 unique IP addresses across 47 countries, with a significant concentration in Germany, the U.S., Turkey, Iran, and France. The exploitation campaign began rapidly, with the first observed connections to attacker infrastructure occurring on August 3, just five days after Broadcom's disclosure and patch release.
QUIRSO's analysis indicates a swift expansion of the attacks, noting 151 new victim IP addresses on August 4, bringing the total to 343 by August 5. By August 7, the cumulative count of compromised IP addresses reached 361.
Upon gaining access to vulnerable vCenter systems, attackers deploy the open-source `reverse_ssh` framework. This tool facilitates persistence and establishes an outbound command-and-control (C2) channel, which can also aid in bypassing network security measures like firewalls. QUIRSO has developed a generic YARA rule to detect `reverse_ssh` client binaries, though it acknowledges that legitimate use of the tool will also trigger alerts.
Broadcom has not provided any workarounds or mitigations for CVE-2026-59310, emphasizing the urgency of applying the available security updates. The specific vCenter releases that address this vulnerability are vCenter 9.1.0.0300, vCenter 9.0.2.0100, and for vCenter 8.0, either 8.0 U3k or 8.0 U2f, depending on the branch.
VMware vCenter is a widely used centralized management platform for virtual infrastructure, including virtual machines, ESXi servers, and access permissions. Its broad control over critical systems makes it a frequent target for malicious actors seeking to achieve data theft or operational disruption.
QUIRSO researchers suspect an advanced persistent threat (APT) actor is responsible for the exploitation activity, though they have not publicly disclosed specific evidence to support this attribution. They are currently withholding specific indicators of compromise due to ongoing coordination with law enforcement agencies and plan to release a more detailed follow-up report covering the attacker's infrastructure, techniques, persistence mechanisms, and post-exploitation activities.
