CVE-2026-59310 is a directory traversal vulnerability in the VMware vCenter Syslog server component that enables remote code execution by attackers with network access. The vulnerability received a CVSS score of 9.8 and was patched by Broadcom on July 29, 2026, alongside other VMware product fixes. Shortly after disclosure, an APT group exploited this flaw to deploy a reverse SSH shell (reverse_ssh) for persistent outbound control connections, bypassing inbound connection blocks. Quirso reported over 360 victim IPs across 47 countries, with exploitation activity starting on August 3, 2026. The attackers leveraged this vulnerability to maintain persistent access and evade typical security controls. A generic YARA rule was released to detect the reverse_ssh payload, but organizations should validate detections for unauthorized installations and unexpected outbound connections.

The vulnerability allows remote attackers with network access to VMware vCenter servers to execute arbitrary code, potentially leading to full system compromise. The exploitation by an APT actor has resulted in persistent unauthorized access to compromised systems via a reverse SSH shell, enabling attackers to maintain control and evade inbound network security measures. The widespread exploitation across multiple countries indicates a significant operational impact on affected organizations.

An official patch was released by Broadcom on July 29, 2026, addressing CVE-2026-59310. Organizations should apply this update immediately to remediate the vulnerability. For systems that may have been compromised, it is recommended to investigate for the presence of the reverse_ssh payload and unauthorized outbound connections. Due to the dual-use nature of the reverse_ssh tool, detections should be validated carefully. No additional generic mitigations are specified by the vendor advisory.