Summary
- CVE-2026-59310 is a CVSS 9.8 vCenter directory traversal vulnerability that can lead to arbitrary code execution.
- Incident responders identified 361 affected IP addresses across 47 countries, with Germany and France among the largest concentrations.
- Broadcom provides no workaround, while already-compromised environments require investigation as well as patching.
A critical VMware vCenter vulnerability disclosed at the end of July is now being used in successful compromises, with incident responders identifying 361 affected IP addresses across 47 countries and significant activity in Germany and France.
Broadcom disclosed CVE-2026-59310 on 29 July as part of VMSA-2026-0006. The flaw is a directory traversal vulnerability in the vCenter Syslog server that can allow a malicious actor with network access to execute arbitrary code. It carries a maximum CVSS score of 9.8.
Broadcom released fixed versions across supported vCenter and VMware Cloud Foundation branches and provides no workaround. Its advisory was subsequently updated on 3 August, the same date on which incident responders say systems in the newly identified campaign began communicating with attacker infrastructure.
QUIRSO identified 361 IP addresses across 47 countries associated with the activity, with Germany, the United States, Turkey, Iran and France forming the largest geographic concentrations. The company cautioned that an IP address does not map neatly to one organisation because hosting, cloud and shared environments complicate the count.
Following initial access, attackers installed a cron job and deployed the open-source reverse_ssh utility, providing persistent outbound remote connectivity. The tool has legitimate uses, so its presence alone is not evidence of compromise, but unauthorised installation and unexpected connections on a vulnerable vCenter server form a substantially stronger indicator.
The earlier vCenter disclosure arrived without public evidence of exploitation. The emergence of forensic evidence only days later changes the operational response from vulnerability remediation alone to a question of whether exposed systems were compromised before updates were installed.
vCenter holds an unusually powerful position within virtualised infrastructure. Administrators use it to control hosts, virtual machines, permissions, templates, networking and other parts of the management plane. Compromise can therefore provide access to infrastructure well beyond the appliance where the initial vulnerability sits.
That concentration makes virtualisation platforms attractive to attackers seeking durable access or a route around controls deployed inside individual workloads. Endpoint tooling running in a guest virtual machine cannot necessarily provide assurance over activity taking place through the platform that creates and administers that machine.
The five-day interval between disclosure and the first identified malicious connections also compresses conventional maintenance assumptions. Infrastructure platforms can require careful testing because a failed update affects many dependent services, yet the campaign demonstrates how little time may remain between public vulnerability information and operational exploitation.
European organisations operating under NIS2 or DORA also face governance questions when a management plane is exposed. Inventory quality, ownership, maintenance arrangements and the ability to investigate administrative infrastructure all influence whether a vulnerability remains a patch-management task or becomes an incident-reporting issue.
Where vCenter was reachable during the exploitation window, installing the current Broadcom update closes the known vulnerability but cannot establish whether earlier access occurred. Review of persistence, unexpected scheduled tasks, outbound connections and other forensic evidence remains separate from remediation.
Broadcom’s update is therefore the start of the response rather than its end for potentially exposed systems. Once active exploitation has been established, the relevant question is no longer simply whether the appliance is vulnerable today, but whether an attacker used it while it was.
