Broadcom VMware vCenter — Active Exploitation Campaign Aiming for Persistent Remote Access via CVE-2026-59310 (CVE-2026-59310, CVE-2026-59309)

Publication date: August 12, 2026
Category: Threat Intelligence / Vulnerabilities

Introduction

Unidentified threat actors have begun actively exploiting a recently patched critical security flaw in Broadcom VMware vCenter, according to new findings published by German cybersecurity firm QUIRSO. The core vulnerability under investigation is CVE-2026-59310, a directory traversal flaw residing within the vCenter Syslog server that enables a network-adjacent or remote attacker to execute arbitrary code. Documented incidents reveal an attack chain structured around path traversal followed by the deployment of malicious cron jobs and the open-source utility reverse_ssh to maintain persistence. Simultaneously, telemetry collection from firms like Defused Cyber indicates a surge in fingerprinting and scanning activities targeting another critical flaw in the same product suite, designated as CVE-2026-59309.

What is VMware vCenter and its Critical Vulnerabilities? (General Analysis)

VMware vCenter Server acts as the centralized management platform for virtual environments within VMware vSphere, allowing administrators to orchestrate ESXi hosts, virtual machines, and associated storage and network resources across data centers. Because vCenter concentrates operational authority into a single administrative tier, any flaw compromising this component grants malicious actors profound administrative oversight over the entire virtualized ecosystem.

In this context, the analyzed vulnerabilities exhibit the following official NVD security profiles:

  • CVE-2026-59310: A directory traversal vulnerability in the VMware vCenter Syslog server. A malicious actor with network access may exploit this issue to execute arbitrary code. It holds an official CVSS v3.1 score of 9.8 (CRITICAL) with an exact vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The weakness is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and is confirmed within the CISA KEV (Known Exploited Vulnerabilities) catalog.
  • CVE-2026-59309: An authentication bypass vulnerability within the VMware Directory Service (vmdir). A malicious actor with network access may exploit this issue to bypass authentication and gain unauthorized access to the system. It carries a CVSS v3.1 score of 9.8 (CRITICAL) with an exact vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Its classification corresponds to CWE-303 (Incorrect Implementation of Identification Algorithm).

How Does It Work? (Technical Analysis)

The campaign analyzed by QUIRSO illustrates how an initial software flaw translates into persistent infrastructure control:

  • Initial Infection Flow and Exploit Entry: The threat actor exploits the path traversal flaw in the Syslog server (CVE-2026-59310) by transmitting crafted network requests without requiring prior credentials (PR:N, UI:N). This mechanism permits manipulation of files on the underlying operating system of the appliance.
  • Persistence Mechanisms and Code Execution: Following successful code execution, attackers deploy malicious scheduled cron jobs to preserve access on the host. To evade perimeter security controls designed to intercept suspicious inbound connections, operators leverage reverse_ssh, an open-source tool used to establish persistent outbound tunnels back to adversary-controlled infrastructure.
  • Parallel Scanning and Reconnaissance: Conversely, activity tied to CVE-2026-59309 involves heightened fingerprinting patterns observed across honeypots, including version probes via POST /sdk/ (RetrieveServiceContent) and traversal of the SAML SSO flow at /websso, pointing to preparation for independent mass-exploitation or advanced reconnaissance campaigns.

Affected Systems / Environments

The exposure impacts enterprise deployments of Broadcom VMware vCenter Server that have failed to apply vendor-issued security updates detailed in advisory VMSA-2026-0006.

CVECategory (CWE)ImpactCVSSVector (summarized)
CVE-2026-59310CWE-22 (Path Traversal)Arbitrary Code Execution9.8 (CRITICAL)AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2026-59309CWE-303 (Auth Bypass)Authentication Bypass / Unauthorized Access9.8 (CRITICAL)AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Mitigation and Detection

Remediation

  • Immediately apply official patches released by Broadcom under security advisory VMSA-2026-0006 across all affected VMware vCenter instances.
  • Strictly restrict access to administrative interfaces and networking service ports of vCenter through rigorous network segmentation (dedicated VLANs, firewall rules, and elimination of direct public internet exposure).
  • Audit system logs for unusual outbound connection patterns or the execution of binaries linked to reverse tunneling utilities such as reverse_ssh.

Detection

Defensive teams should monitor specific indicators of compromise and operational anomalies across appliances:

  • Track anomalous HTTP requests aimed at web service endpoints like POST /sdk/ alongside traversal attempts in SAML workflows (/websso).
  • Inspect the creation of suspicious scheduled jobs (cron jobs) within the underlying OS paths of the vCenter server.
  • Search for unexpected outbound network traffic directed toward unknown external destinations originating from internal appliance services.

“The presence of reverse_ssh should not, by itself, be treated as proof of malicious activity; in combination with unauthorized installation, unexpected outbound connections or execution on a vulnerable vCenter appliance, however, it is a high-priority indicator requiring investigation.”

Wrapping Up

The active exploitation of CVE-2026-59310 in VMware vCenter highlights the velocity with which threat actors operationalize critical vulnerabilities following public disclosure. The utilization of stealthy persistence via outbound tunneling (reverse_ssh) alongside parallel reconnaissance aimed at authentication bypass (CVE-2026-59309) demonstrates an enduring, high-severity risk to virtualized enterprise infrastructures. Prioritizing the deployment of official Broadcom patches and maintaining proactive network and log monitoring remain essential pillars for neutralizing these campaigns.

References