CVE-2026-59310

What is VMware vCenter?

VMware vCenter Server is the centralised management plane for a vSphere environment. It inventories and controls every ESXi host, virtual machine, datastore, and virtual network in the cluster, and it holds the credentials and SSO trust needed to do so.

Compromising vCenter is therefore not a single-host compromise — it is administrative control over the entire virtual estate. An attacker with vCenter can deploy or clone VMs, snapshot and exfiltrate disk images, disable logging, and push commands to ESXi hosts. This is why ransomware operators have consistently treated vCenter and ESXi as priority targets: encrypting at the hypervisor layer takes down every guest at once.

Overview

CVE-2026-59310 is a path traversal vulnerability (CWE-22) in the vCenter Syslog service that allows a malicious actor with network access to vCenter to execute arbitrary code without authentication. Broadcom rates it Critical with a maximum CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H).

Broadcom released fixes on 2026-07-29. Mass exploitation began 2026-08-03 — five calendar days later — and expanded to hundreds of victims within 48 hours. CISA added the CVE to KEV on 2026-08-18 with a 2026-08-21 deadline.

Affected Versions

There are no workarounds. Broadcom published no mitigations for this issue — patching is the only remediation.

Technical Details

The vulnerable component is the Syslog server bundled with vCenter. Insufficient validation of path input allows an attacker to traverse outside the intended directory, and that traversal is sufficient to reach arbitrary code execution on the appliance.

The CVSS vector tells the operationally important part of the story:

• AV:N / AC:L — reachable over the network with low attack complexity.
• PR:N — no privileges required; the attacker needs no vCenter account.
• UI:N — no administrator has to click anything.
• C:H/I:H/A:H — full compromise of confidentiality, integrity, and availability.

In other words, network reachability to the vCenter appliance is the only real precondition. Anything that can route to the syslog listener can attempt exploitation.

Discovery

The vulnerability was addressed in Broadcom's security advisory of 2026-07-29. The subsequent exploitation campaign was identified and documented by the DFIR firm QUIRSO, whose telemetry established both the timeline and the post-exploitation tooling.

Exploitation Context

This is one of the faster patch-to-mass-exploitation cycles on record for an enterprise virtualisation product:

QUIRSO identified compromises at 361 IP addresses across 47 countries, with the heaviest concentrations in Germany, the United States, Turkey, Iran, and France — a pattern consistent with indiscriminate internet-wide scanning rather than targeted operations.

Post-exploitation, attackers deployed the open-source reverse_ssh framework. This establishes an outbound command-and-control channel from the vCenter appliance, which both provides durable remote access and helps bypass firewalls and egress filtering that would block inbound connections. Because the callback is outbound and uses SSH, it blends into normal administrative traffic patterns.

Remediation

1. Patch immediately to vCenter 9.1.0.0300, 9.0.2.0100, or 8.0 U3k / 8.0 U2f. No mitigations or workarounds exist.
2. Prioritise instances reachable from untrusted or broad internal networks — but note that internal-only reachability is not safety here, given that no authentication is required.
3. Assume compromise for any instance that was internet-reachable and unpatched on or after 2026-08-03. The exploitation window is well documented and the victim count is high.
4. Hunt for reverse_ssh artefacts — unexpected outbound SSH connections from the vCenter appliance, unfamiliar processes or persistence entries, and connections to infrastructure not in your management inventory.
5. Review the syslog service for anomalous requests, crashes, or path-traversal patterns in its logs.
6. If compromise is confirmed, rotate credentials broadly: vCenter local and SSO accounts, service accounts integrated with vCenter, ESXi host root passwords, and any API tokens or backup-integration credentials the appliance held.
7. Restrict management-plane network access so vCenter is reachable only from a dedicated administrative network or jump host — a control that would have blunted this campaign regardless of patch state.