VMware vCenter CVE-2026-59310 Exploitation
Threat actors have started to target a critical security vulnerability that has been recently patched by Broadcom VMware vCenter. The vulnerability gives attackers an opportunity to run any code on the affected system.
The vulnerability is identified by the number CVE-2026-59310, which has a CVSS score of 9.8. This is a directory traversal vulnerability, which a threat actor who has network access can leverage to run arbitrary code. Broadcom has fixed the vulnerability recently.
Here is the explanation of VMware vCenter CVE-2026-59310 exploitation campaign and everything organizations should be aware of.
Key Points About the Vulnerability
- CVE-2026-59310 is a directory-traversal vulnerability in vCenter Server
- It allows attackers with network access to execute arbitrary code
- The CVSS score is 9.8 (Critical)
- Broadcom released patches in late July 2026
- Active exploitation began shortly after disclosure
- Attackers are deploying reverse_ssh backdoors
The Attack Chain
QUIRSO discovered the VMware vCenter CVE-2026-59310 exploitation following an incident response engagement. Attack chain has the following structure:
Step 1: Initial Access
- Exploit the directory-traversal vulnerability
- Result in executing arbitrary code on the vCenter server
Step 2: Persistence
- Attackers deploy a malicious cron job
- The cron job establishes persistence on the host
Step 3: Backdoor Installation
- Attackers install reverse_ssh
- reverse_ssh is an open-source SSH connection tool
- It connects to threat actor-controlled infrastructure
Step 4: Ongoing Access
- The reverse_ssh backdoor provides persistent access
- Attackers can maintain control over the compromised system
The Scale of the Campaign
The VMware vCenter CVE-2026-59310 exploitation campaign is widespread:
- 361 unique victim IP addresses
- 47 countries affected
- Most affected countries: Germany, U.S., Turkey, Iran, France
Timeline:
- July 28: Broadcom publicly disclosed the vulnerability
- August 3: Compromised systems began contacting attacker domains
- Attackers exploited the flaw within five days of disclosure
QUIRSO noted that "the strong correlation between the time of disclosure and exploitation suggests the disclosure as the initial starting point for the campaign."
The Attacker
The identity of the attackers is not yet known. However, QUIRSO believes it is the work of a suspected advanced persistent threat actor.
Historical Context:
- VMware appliances have been lucrative targets for Chinese threat actors
- UNC5174 has weaponized VMware Tools and vCenter flaws
- PurpleHaze targeted a South Asian government entity with GoReShell
- GoReShell uses reverse_ssh functionality for reverse SSH connections
PurpleHaze Details (April 2025):
- Targeted a South Asian government supporting entity
- Used a Windows backdoor called GoReShell
- GoReShell establishes reverse SSH connections
- This allows bypassing inbound security controls
What Is reverse_ssh?
reverse_ssh is an open-source tool used for setting up SSH connections to attacker-controlled infrastructure.
How It Works:
- Establishes an outbound connection to an attacker-controlled endpoint
- Bypasses security controls designed for inbound requests
- Provides persistent access to the compromised system
Detection Guidance:
- reverse_ssh should not be treated as proof of malicious activity by itself
- Combined with unauthorized installation, it is a high-priority indicator
- Unexpected outbound connections warrant investigation
- Execution on a vulnerable vCenter appliance is suspicious
The CVE-2026-59309 Connection
The VMware vCenter CVE-2026-59310 exploitation disclosure comes as Defused Cyber is observing a spike in scanning against VMware vCenter. This scanning is a sign of possible exploitation attempts against CVE-2026-59309.
Details about CVE-2026-59309:
- CVSS score: 9.8
- Authentication bypass without authentication in vmdir
- Patch was available in VMSA-2026-0006
Observed Scanning Activity:
- Version probes via POST /sdk/ (RetrieveServiceContent)
- Walks of the /websso SAML SSO flow
- Coincides with Broadcom's VMSA-2026-0006 release
Correlation Status:
Denis Szadkowski, COO and co-founder of QUIRSO, told The Hacker News: "There is not enough evidence at this stage to correlate exploitation and scanning efforts using CVE-2026-59309 with the intrusion set or the attacker infrastructure associated with CVE-2026-59310."
Immediate Actions Required by Organizations
Exploitation of VMware vCenter CVE-2026-59310 Vulnerability is a critical issue at hand:
Immediate Actions Required:
- Deploy patches provided by Broadcom immediately
- Patches were published in mid-July 2026
- Look for CVE-2026-59310 and CVE-2026-59309
Detection & Monitoring:
- Monitor for any cron jobs generated
- Monitor for any installation of reverse_ssh
- Check for any suspicious outgoing connection
- VCenter log checking for path traversal
- Check for any access
- Find all instances of VMware vCenter
- Check patches
- Look for signs of compromise
- Check out incident response policies
Wrapping It Up
The exploitation attack against the VMware vCenter CVE-2026-59310 vulnerability continues to target organizations around the world. Attackers are exploiting the directory-traversal vulnerability to deploy reverse_ssh backdoors.
Key points to remember:
- CVE-2026-59310 is a critical directory-traversal flaw
- CVSS score is 9.8
- Active exploitation began five days after disclosure
- 361 unique victim IPs in 47 countries
- reverse_ssh backdoors provide persistent access
- CVE-2026-59309 scanning is also occurring
Organizations should apply Broadcom's patches immediately. Monitor for signs of compromise.Analyze any abnormal cron job creation and outgoing connection activities.
VMware vCenter exploitation operation due to CVE-2026-59310 serves as a warning that threat actors act swiftly in the wake of a vulnerability revelation.
FAQ Section
What is CVE-2026-59310?
It is a critical directory-traversal vulnerability in VMware vCenter Server. It allows attackers with network access to execute arbitrary code. The CVSS score is 9.8.
Is the vulnerability currently being exploited?
Yes. The exploit has been observed by QUIRSO starting soon after Broadcom's disclosure. There are 361 different victim IPs from 47 countries.
What happens once attackers have successfully exploited the vulnerability?
The attackers create a malicious cron job for persistence. Reverse_ssh is an open-source tool used for connecting through SSH to the attacker-controlled infrastructure.
Who is behind the attacks?
The identity of the attackers is not yet known. QUIRSO believes it is the work of a suspected advanced persistent threat actor.
What should organizations do?
Apply Broadcom's patches immediately. Monitor for unusual cron job creation and reverse_ssh installations. Investigate unexpected outbound connections.
