Attackers exploit patched VMware vCenter flaw to install reverse SSH backdoors
Attackers began exploiting a critical VMware vCenter vulnerability within days of Broadcom's July 29, 2026, patch, with more than 360 victim IP addresses identified by early August. The flaw, CVE-2026-59310, is a directory traversal bug in vCenter's Syslog server that can let an attacker with network access run arbitrary code.
vCenter controls entire virtualization estates. Control of it can let an intruder reach, copy or encrypt every virtual machine it manages, which is why ransomware groups prize it.
What happened
Broadcom fixed the bug in VMSA-2026-0006, alongside other flaws in ESX, vCenter, Workstation and Fusion, and rated it 9.8. It offered no workarounds.
The incident response firm QUIRSO reported that attacker-controlled connections began Aug. 3, about five days after the patch, and counted 361 victim IPs across 47 countries by Aug. 7, BleepingComputer reported on Aug. 13. More than half were in Germany, the U.S., Turkey, Iran and France. The attacker installed the open-source reverse_ssh tool for persistence. QUIRSO said it believed an advanced persistent threat actor was responsible but withheld specific indicators, citing coordination with law enforcement.
CISA added CVE-2026-59310 to its Known Exploited Vulnerabilities catalogue on Aug. 18 and later updated the entry to say the flaw is known to be used in ransomware campaigns. The Canadian Centre for Cyber Security updated its advisory AV26-763 on Aug. 18 to reflect the KEV listing.
What we don't know yet
Broadcom had not responded publicly to QUIRSO's findings when the exploitation was reported. Which ransomware groups are using the flaw, and whether any Canadian organizations were hit, has not been disclosed.
Fixed versions
- vCenter 9.1: 9.1.0.0300
- vCenter 9.0: 9.0.2.0100
- vCenter 8.0: 8.0 U3k
- VMware Cloud Foundation and vSphere Foundation deployments should follow Broadcom's advisory for their releases.
What to do
- Patch vCenter now; Broadcom told customers to treat the update as an emergency.
- Make sure vCenter is not reachable from the internet and restrict network access to administrators.
- Check vCenter appliances for unexpected outbound connections and unknown binaries, including reverse_ssh clients.
- If compromise is suspected, assume credentials stored in vCenter are exposed and rotate them.
Because exploitation started within a week of the patch, organizations that delayed the update should check for compromise even after installing it.
Key points
- CVE-2026-59310 is a 9.8-rated directory traversal flaw in the VMware vCenter Syslog server.
- Broadcom patched it July 29, 2026; exploitation began about Aug. 3.
- QUIRSO counted 361 victim IPs in 47 countries; attackers installed reverse_ssh.
- CISA added it to KEV Aug. 18 and later flagged ransomware use.
