Threat ActorPublished 15 Sep 2026

CISA: Critical VMware RCE flaw now exploited by ransomware gangs

Source Bleeping Computer

Mentions 1 CVE

Mentioned vulnerabilities

CVE-2026-59310

Description

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned security teams that ransomware gangs have now joined ongoing attacks exploiting a critical VMware vCenter vulnerability patched in July. [...]

Impact

Exploitation of CVE-2026-59310 allows unauthenticated attackers to execute arbitrary code on VMware vCenter servers, potentially leading to full system compromise. This access can enable ransomware gangs to deploy encryption payloads targeting virtual machines and internal networks, risking significant data loss and operational disruption. The vulnerability has been actively exploited in the wild, including by ransomware groups, increasing the urgency for patching. Compromise of vCenter or ESXi servers can provide attackers with broad access to enterprise environments.

Defensive guidance

An official patch for CVE-2026-59310 was released by Broadcom on July 29, 2026. Organizations should apply this patch immediately to remediate the vulnerability. CISA has mandated government agencies to secure affected systems within three days. Given active exploitation by ransomware gangs, prompt patching is critical. No additional mitigation steps are specified beyond applying the official update.

Summary

CVE-2026-59310 is a critical directory traversal vulnerability in the VMware vCenter Syslog server that enables unauthenticated remote code execution. Patched by Broadcom on July 29, 2026, it has been actively exploited by advanced persistent threat actors and ransomware gangs to gain remote access and persistence via reverse SSH. CISA has included this vulnerability in its Known Exploited Vulnerabilities Catalog and ordered rapid remediation for government systems. Over 450 exposed VMware vCenter servers remain online, with unknown patch status. This vulnerability is one of several VMware flaws exploited in recent ransomware campaigns targeting virtual infrastructure.

References

bleepingcomputer.com/news/security/cisa-critical-vmware-vcenter-rce-flaw-now-exploited-by-ransomware-gangs/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 16 Sep 2026, 05:47 UTC

References

Community reviews

Related threats