CVE-2026-59310 is a critical directory traversal vulnerability in the VMware vCenter Syslog server that enables unauthenticated remote code execution. Patched by Broadcom on July 29, 2026, it has been actively exploited by advanced persistent threat actors and ransomware gangs to gain remote access and persistence via reverse SSH. CISA has included this vulnerability in its Known Exploited Vulnerabilities Catalog and ordered rapid remediation for government systems. Over 450 exposed VMware vCenter servers remain online, with unknown patch status. This vulnerability is one of several VMware flaws exploited in recent ransomware campaigns targeting virtual infrastructure.

Exploitation of CVE-2026-59310 allows unauthenticated attackers to execute arbitrary code on VMware vCenter servers, potentially leading to full system compromise. This access can enable ransomware gangs to deploy encryption payloads targeting virtual machines and internal networks, risking significant data loss and operational disruption. The vulnerability has been actively exploited in the wild, including by ransomware groups, increasing the urgency for patching. Compromise of vCenter or ESXi servers can provide attackers with broad access to enterprise environments.

An official patch for CVE-2026-59310 was released by Broadcom on July 29, 2026. Organizations should apply this patch immediately to remediate the vulnerability. CISA has mandated government agencies to secure affected systems within three days. Given active exploitation by ransomware gangs, prompt patching is critical. No additional mitigation steps are specified beyond applying the official update.