Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access

Threat actors are actively exploiting a recently patched critical vulnerability in Broadcom VMware vCenter Server to compromise exposed systems and establish persistent remote access.

The vulnerability, tracked as CVE-2026-59310, is a directory-traversal flaw in the VMware vCenter Server Syslog component. It carries a CVSS score of 9.8 and can allow an attacker with network access to execute arbitrary code.

Security researchers from QUIRSO identified successful compromises involving the vulnerability. The activity began only days after Broadcom publicly disclosed the flaw.

Key Highlights

• Vulnerability: CVE-2026-59310
• CVSS Score: 9.8 Critical
• Product: VMware vCenter Server
• Vulnerability Type: Directory Traversal
• Impact: Arbitrary Code Execution
• Exploitation observed beginning August 3, 2026
• 361 unique victim IP addresses identified
• Victims observed across 47 countries
• Attackers deployed reverse_ssh
• Persistence was established through a malicious cron job
• Attackers used outbound connections to maintain remote access
• Germany, United States, Turkey, Iran and France were among the most affected locations

Vulnerability Overview

CVE-2026-59310 is a critical directory-traversal vulnerability affecting VMware vCenter Server.

An attacker with network access to a vulnerable vCenter Server can exploit the flaw to traverse directories and execute arbitrary code on the underlying appliance.

Broadcom disclosed the vulnerability through VMSA-2026-0006 on July 29, 2026, and released security updates for affected vCenter versions.

Active Exploitation

QUIRSO identified successful exploitation activity beginning on August 3, approximately five days after the vulnerability was publicly disclosed.

The researchers identified as many as 361 unique victim IP addresses across 47 countries.

The largest number of observed victim IP addresses were associated with:

• Germany
• United States
• Turkey
• Iran
• France

The rapid increase in observed victims suggests widespread scanning and opportunistic exploitation of internet-accessible VMware vCenter deployments.

Attack Chain

The observed attack chain begins with exploitation of CVE-2026-59310.

After gaining access to the vulnerable vCenter appliance, attackers deploy a malicious cron job that launches the reverse_ssh tool.

The attack chain can be summarized as:

Internet-Exposed vCenter → CVE-2026-59310 Exploitation → Arbitrary Code Execution → Malicious Cron Job → reverse_ssh → Outbound Remote Access

Persistence Through reverse_ssh

The attackers used reverse_ssh, an open-source SSH-based reverse-shell framework, to maintain access to compromised systems.

Unlike traditional inbound remote access, reverse SSH allows the compromised system to initiate an outbound connection toward attacker-controlled infrastructure.

This can help attackers bypass network controls that restrict inbound connections to VMware management systems.

The tool can provide capabilities including:

• Reverse SSH connections
• Port forwarding
• File transfers
• Remote shell access
• Persistent outbound communication

The presence of reverse_ssh alone does not prove malicious activity. However, its unauthorized installation on a vulnerable vCenter appliance combined with unexpected outbound connections should be treated as a high-priority investigation.

Infrastructure Impact

VMware vCenter is a central management component within many virtualized environments.

Compromise of a vCenter appliance can provide attackers with a strategic position inside the infrastructure and potentially enable further attacks against virtual machines and supporting systems.

Organizations should therefore treat exposed and unpatched vCenter systems as high-risk assets.

Related VMware Activity

The campaign follows the disclosure of multiple critical VMware vulnerabilities.

Security researchers have also observed increased scanning activity targeting CVE-2026-59309, another critical VMware vCenter vulnerability with a CVSS score of 9.8.

However, researchers have stated that there is currently insufficient evidence to directly associate the CVE-2026-59309 scanning activity with the intrusion infrastructure observed exploiting CVE-2026-59310.

Detection and Hunting Opportunities

Security teams should monitor for:

• Exploitation attempts against VMware vCenter
• Suspicious path-traversal requests
• Unexpected files created on vCenter appliances
• Unauthorized cron jobs
• Execution of reverse_ssh
• Unexpected SSH processes
• Outbound SSH connections from vCenter appliances
• Connections from vCenter servers to unfamiliar external IP addresses
• Unknown binaries in VMware system directories
• Unexpected persistence mechanisms
• Unusual network traffic originating from vCenter management systems
• vCenter systems communicating directly with external infrastructure

Recommended Mitigations

1. Immediately patch all affected VMware vCenter Server systems.
2. Identify all internet-accessible vCenter deployments.
3. Restrict vCenter management interfaces to trusted administrative networks.
4. Review vCenter logs for suspicious activity beginning August 3, 2026.
5. Search for unauthorized reverse_ssh binaries.
6. Review cron jobs for unauthorized persistence.
7. Investigate unexpected outbound SSH connections.
8. Monitor vCenter appliances for unknown processes and files.
9. Isolate potentially compromised vCenter systems before forensic investigation.
10. Review Broadcom security updates and apply the appropriate versions.
11. Monitor network telemetry for connections from vCenter systems to unfamiliar external hosts.
12. Treat unpatched internet-facing vCenter systems as potentially compromised until verified otherwise.

Threat Assessment

The exploitation of CVE-2026-59310 demonstrates how quickly attackers can weaponize newly disclosed vulnerabilities affecting internet-facing infrastructure.

The short interval between public disclosure and observed exploitation significantly reduces the available remediation window for defenders.

The deployment of reverse_ssh is particularly concerning because it provides attackers with an outbound control channel that can help maintain access even when inbound access to the compromised vCenter appliance is restricted.

Organizations should prioritize patching, management-plane isolation and proactive threat hunting across all exposed VMware vCenter environments.

Conclusion

The active exploitation of CVE-2026-59310 highlights the importance of rapid vulnerability remediation for internet-facing virtualization infrastructure.

Security teams should immediately identify vulnerable vCenter systems, apply Broadcom's security updates, review historical logs and network telemetry, and hunt for unauthorized cron jobs, reverse_ssh binaries and unexpected outbound SSH connections.