VulnerabilityPublished 13 Aug 2026

Critical VMware vCenter Vulnerability in Attackers’ Crosshairs

Source SecurityWeek

Mentioned vulnerabilities

CVE-2026-59310

Severity

Critical

Rated Critical by Threat Radar from the SecurityWeek text

Data as of 13 Aug 2026, 20:37 UTC

What to do

AI-suggested

An official patch was released by Broadcom on July 29, 2026, addressing CVE-2026-59310. Organizations should apply this update immediately to remediate the vulnerability. For systems that may have been compromised, it is recommended to investigate for the presence of the reverse_ssh payload and unauthorized outbound connections. Due to the dual-use nature of the reverse_ssh tool, detections should be validated carefully. No additional generic mitigations are specified by the vendor advisory.

Description

Tracked as CVE-2026–59310, the directory traversal bug allows remote attackers to execute arbitrary code. The post Critical VMware vCenter Vulnerability in Attackers’ Crosshairs appeared first on SecurityWeek .

Impact

The vulnerability allows remote attackers with network access to VMware vCenter servers to execute arbitrary code, potentially leading to full system compromise. The exploitation by an APT actor has resulted in persistent unauthorized access to compromised systems via a reverse SSH shell, enabling attackers to maintain control and evade inbound network security measures. The widespread exploitation across multiple countries indicates a significant operational impact on affected organizations.

Summary

CVE-2026-59310 is a directory traversal vulnerability in the VMware vCenter Syslog server component that enables remote code execution by attackers with network access. The vulnerability received a CVSS score of 9.8 and was patched by Broadcom on July 29, 2026, alongside other VMware product fixes. Shortly after disclosure, an APT group exploited this flaw to deploy a reverse SSH shell (reverse_ssh) for persistent outbound control connections, bypassing inbound connection blocks. Quirso reported over 360 victim IPs across 47 countries, with exploitation activity starting on August 3, 2026. The attackers leveraged this vulnerability to maintain persistent access and evade typical security controls. A generic YARA rule was released to detect the reverse_ssh payload, but organizations should validate detections for unauthorized installations and unexpected outbound connections.

References

securityweek.com/critical-vmware-vcenter-vulnerability-in-attackers-crosshairs/ (opens in a new tab)

Community reviews

Loading reviews…

What to do

Description

AI analysisMachine-generated, updated 13 Aug 2026, 09:11 UTC

References

Community reviews

Related threats