A critical vulnerability in VMware vCenter, identified as CVE-2026-59310, was actively exploited by attackers within five days of its public disclosure by Broadcom. The flaw, a directory traversal vulnerability in the vCenter Syslog server, carries a CVSS score of 9.8, indicating its severe nature. Broadcom confirmed that an unauthenticated attacker with network access to vCenter could leverage this vulnerability to execute arbitrary code, effectively turning the log collection service into an entry point to the underlying operating system.
The exploitation campaign was uncovered by the threat research team at Quirso, a German digital forensics firm, during an incident response engagement. Quirso published its findings on August 10, noting that the attackers deployed an open-source SSH-based reverse shell, `reverse_ssh`, for persistent access to compromised systems. This type of shell establishes outbound connections, which can help it bypass typical inbound network security controls.
Broadcom initially released an advisory for CVE-2026-59310 on July 29, stating at the time that no exploitation had been observed. However, the advisory was updated on August 3 to include express patches for vCenter version 8.0 U2f. Quirso's investigation revealed that the first observed contact from compromised systems to attacker infrastructure occurred on August 3, the same day Broadcom updated its advisory.
The scale of the attack rapidly escalated. On August 4, an additional 151 victim IP addresses were identified. By August 5, approximately 95% of the total 361 victim IP addresses observed by Quirso had appeared. These victims were spread across 47 countries, with Germany, the United States, Turkey, Iran, and France accounting for 185 of them. While the possibility of attackers having prior knowledge of the flaw exists, Quirso highlighted the strong correlation between the public disclosure and the onset of exploitation, suggesting the advisory served as a trigger for the campaign.
Quirso assessed that a suspected advanced persistent threat (APT) actor was likely responsible for the attacks. It is important to note that the presence of the `reverse_ssh` tool alone does not definitively prove a compromise, but it is a strong indicator.
Broadcom has not provided a workaround for the vulnerability. Patches are available in vCenter releases 9.1.0.0300, 9.0.2.0100, and either 8.0 U3k or 8.0 U2f, depending on the deployed branch. These updates also address another critical vulnerability mentioned in the advisory: an authentication bypass in VMware Directory Service. Organizations are advised that simply patching the vulnerability is not sufficient; they must also identify and evict any attackers who may have gained access before the patch was applied.
