Attackers Exploit Critical CVE-2026-59310 in VMware vCenter for Persistent Remote Access

Attackers are actively exploiting the critical vulnerability CVE-2026-59310 in Broadcom VMware vCenter Server to gain persistent remote access on internet-exposed systems. The flaw affects the Syslog server component and allows unauthenticated remote code execution via a path traversal technique that lets adversaries manipulate file paths and execute arbitrary commands on the appliance.

The vulnerability carries a CVSS 9.8 severity rating, indicating near-complete compromise potential with minimal attacker effort. Exploitation activity began shortly after disclosure, with the first observed incidents recorded on 3 August 2026. Once initial access is obtained, threat actors establish persistence by installing malicious cron tasks and deploying the reverse_ssh utility, which creates stable outbound connections that often bypass inbound-focused defenses.

According to telemetry shared by researchers, the campaign has already compromised 361 unique victim IP addresses spread across 47 countries. The highest concentrations of affected systems were found in Germany, the United States, Turkey, Iran, and France. Many of these instances were directly reachable from the internet, dramatically increasing the speed and scale of successful attacks.

Broadcom has published official fixes in security advisory VMSA-2026-0006.1. The update resolves both CVE-2026-59310 and the related CVE-2026-59309. No alternative mitigations are available, so organizations must apply the patches without delay. Additional recommended actions include confirming that vCenter is not exposed to the internet, enforcing network segmentation and access-control lists, and auditing appliances for unauthorized cron entries, reverse_ssh binaries, and anomalous outbound connections.

Security researchers also noted a concurrent rise in scanning activity targeting the same attack surface, although a direct link to the ongoing exploitation of CVE-2026-59310 has not yet been confirmed. The short window between disclosure and active exploitation underscores the urgency of applying updates to virtualized infrastructure.