Threat researchers have confirmed an active exploitation campaign against VMware vCenter servers targeting CVE-2026-59310, a critical directory-traversal vulnerability rated CVSS 9.8. Incident responders from QUIRSO engaged 361 unique victim environments across 47 countries after Broadcom published the patch in late July 2026. Attackers who successfully exploit this flaw achieve arbitrary code execution on the vCenter host and deploy a reverse_ssh binary for persistent, outbound command-and-control. If you run vCenter and have not yet applied Broadcom’s July 2026 patch, your environment is actively being targeted.

What the Vulnerability Is

CVE-2026-59310 is a directory-traversal vulnerability in VMware vCenter Server. The flaw allows an unauthenticated remote attacker to send a crafted HTTP request that navigates outside the intended directory scope on the vCenter host. The traversal leads to arbitrary code execution — an attacker can write and execute files on the underlying operating system without needing vCenter credentials or administrator access.

The observed attack chain in the wild follows a consistent pattern:

  1. Path traversal — attacker sends a crafted request exploiting the directory-traversal flaw
  2. Malicious cron job deployment — a cron job is written to the host, establishing persistence
  3. Reverse SSH installation — the reverse_ssh open-source tool is deployed, creating an outbound SSH tunnel back to attacker-controlled infrastructure. Outbound connections are harder to block than inbound ones at the firewall level, which is why this technique is favored by APT actors.

A related vulnerability, CVE-2026-59309 (CVSS 9.8, vmdir unauthenticated authentication bypass), is also being actively scanned and probed. Broadcom’s patch addresses both.

The timeline is concerning: Broadcom disclosed and patched these issues in late July 2026. Exploitation in the wild began August 3 — just five days after public disclosure. The speed of weaponization is consistent with nation-state-level threat actor resources. Incident responders have attributed the campaign with medium confidence to a suspected Chinese state-sponsored APT, noting tactical similarities to UNC5174/PurpleHaze.

Why It Matters

  • vCenter controls everything in the virtual environment. Compromise of the vCenter management plane gives an attacker the ability to control every virtual machine on the cluster — spin them up, shut them down, snapshot them, or exfiltrate their disk images.
  • Active exploitation at scale. 361 confirmed victims across 47 countries including Germany, the United States, Turkey, Iran, and France in the first week of the campaign is an unusually broad sweep. This is not opportunistic scanning — it is a targeted campaign against known vCenter deployments.
  • Persistent access via reverse SSH. Reverse SSH creates an outbound tunnel that survives reboots (via the installed cron job) and traverses most firewall rules. Remediation is not as simple as patching — if exploitation occurred before patching, the implant must be actively hunted and removed.
  • CVSS 9.8 with no authentication required. The flaw requires no credentials, no user interaction, and is exploitable over the network. The attack surface is any vCenter instance reachable on the network.
  • Hosting providers and MSPs are high-value targets. Multi-tenant vCenter environments — used by managed hosting providers to run customer VMs — represent a single point of compromise for many downstream organizations.

Am I Affected?

  • You run VMware vCenter Server on any version that has not received Broadcom’s late-July 2026 security patch for CVE-2026-59310.
  • The vulnerability is exploitable from any network that can reach vCenter’s management interface. If vCenter is reachable from the internet or from a segment you don’t fully control, exposure is high.
  • Even vCenter instances behind a VPN should be patched — lateral movement from an already-compromised network segment is a realistic attack path.
  • VMware vSphere environments using the embedded Platform Services Controller (PSC) are also in scope.
  • VMware Cloud on AWS and other fully-managed VMware cloud services: check your vendor’s advisory for patch status in their managed infrastructure.

What to Do About It: Step-by-Step

Step 1: Identify your vCenter version

# Log into vSphere Client → Administration → System Configuration → Nodes
# Check the build number against Broadcom's advisory for CVE-2026-59310
# Or via SSH to vCenter Appliance (VCSA):
vpxd -v

Step 2: Apply Broadcom’s patch for CVE-2026-59310

Download the patch from Broadcom’s VMware Security Advisory portal and follow the standard VCSA patching procedure:

# Via vSphere Client: Administration → System Configuration → Update
# Or stage the patch via VCSA management interface (https://<vcenter>:5480)
# Select: Software → Update → Check Updates → Stage and Install

Broadcom has also released patches for CVE-2026-59309 in the same advisory — apply both.

Step 3: Restrict network access to vCenter immediately

If you cannot patch right now, restrict access to vCenter’s management interface (default ports 443, 9443, 5480) to only authorized management workstations or jump hosts. vCenter should never be reachable directly from the public internet.

# Example: block external access to vCenter management ports via firewall
# Allow only management network segment (e.g., 10.0.1.0/24):
# iptables -I INPUT -p tcp --dport 443 -s 10.0.1.0/24 -j ACCEPT
# iptables -I INPUT -p tcp --dport 443 -j DROP

Step 4: Hunt for indicators of compromise

If there is any chance exploitation occurred before patching, investigate before declaring the environment clean:

# Check for suspicious cron jobs on the vCenter appliance:
crontab -l
ls -la /var/spool/cron/
ls -la /etc/cron*/

# Look for the reverse_ssh binary:
find / -name "reverse_ssh" 2>/dev/null
find /tmp /var/tmp /dev/shm -type f 2>/dev/null | xargs file | grep ELF

# Check for unexpected outbound SSH connections:
ss -tnp | grep ESTAB | grep :22
netstat -tnp | grep ESTAB

Step 5: Review vCenter logs for exploitation activity

Exploitation of the directory traversal generates anomalous request patterns in vCenter’s HTTP logs:

# VCSA HTTP request logs:
tail -n 500 /var/log/vmware/rhttpproxy/access.log | grep "\.\."
# Look for path traversal sequences (../, ..%2F, etc.)
grep -E "(%2F|%2f)?\.\." /var/log/vmware/rhttpproxy/access.log

Step 6: If compromised, isolate and rebuild

A vCenter compromise is a Tier-1 incident. Isolate the affected host, engage incident response, preserve logs and memory for forensic analysis, and plan for a clean rebuild from a known-good backup taken before the exploitation window (August 3, 2026 or earlier).

Quick-Win Checklist

  • Verify your vCenter build number and confirm whether Broadcom’s CVE-2026-59310 patch is applied.
  • If unpatched: firewall vCenter management ports immediately to authorized hosts only.
  • Apply Broadcom’s patch for CVE-2026-59310 and CVE-2026-59309.
  • Hunt for reverse_ssh binary and malicious cron jobs on the VCSA.
  • Review VCSA HTTP logs for path-traversal request patterns.
  • Verify no unexpected outbound SSH connections from the vCenter host.
  • If exploitation is confirmed, treat as a Tier-1 incident and consider environment rebuild.
  • Permanently segment vCenter management interfaces from untrusted networks.

Sources

DALL-E Image Prompt

8-bit pixel-art scene: a data center server rack labeled “vCenter” with a glowing red directory path arrow bypassing a locked folder and reaching a terminal executing a command. A reverse-arrow SSH tunnel shoots outward to a distant shadowy control server. Warning indicators flash in orange and red. Dark neon color scheme on a black background.