VMware vCenter CVE-2026-59310 Actively Exploited

VMware vCenter CVE-2026-59310: Critical Vulnerability Actively Exploited in the Wild

A critical vulnerability in VMware vCenter Server is now being actively exploited in the wild. Security researchers have identified successful compromises where attackers used the vulnerability to gain access to vulnerable vCenter systems and establish persistence.

Tracked as CVE-2026-59310, the vulnerability has a CVSS score of 9.8 and affects the VMware vCenter Server Syslog component. According to Broadcom, an attacker with network access to a vulnerable vCenter Server may exploit the flaw to execute arbitrary code.

What makes this incident especially concerning is what happens after the initial exploitation. Researchers have observed attackers using malicious cron jobs and reverse SSH connections to maintain access to compromised systems.

For organizations running VMware vCenter, this is no longer a vulnerability that can simply be added to a patching queue. It should be investigated and addressed as a high-priority security issue.

What Is CVE-2026-59310?

CVE-2026-59310 is a critical directory traversal vulnerability affecting the Syslog server component of VMware vCenter Server.

Broadcom has rated the vulnerability Critical, with a maximum CVSS v3 score of 9.8. The identified attack vector requires network access to vCenter, after which a malicious actor may exploit the vulnerability to execute arbitrary code. In simple terms, a successful attack could give an attacker the ability to execute commands on a vulnerable vCenter Server. That is particularly serious because vCenter is a central management platform for VMware environments. A compromised vCenter Server can give an attacker valuable visibility into the organization's virtual infrastructure and potentially provide a path toward further compromise.

CVE-2026-59310 Is Being Actively Exploited

The biggest concern surrounding this VMware vCenter vulnerability is that exploitation has moved from a theoretical risk to real-world attacks. According to research cited in the recent investigation, compromised systems began communicating with attacker-controlled infrastructure around August 3, 2026, shortly after the vulnerability was publicly disclosed.

The investigation identified:

• 361 unique victim IP addresses

• Victims across 47 countries

• Significant numbers of victims in Germany, the United States, Turkey, Iran and France

• Activity consistent with exploitation of CVE-2026-59310

• Malicious cron jobs used for persistence

• reverse_shh used to establish remote access

The timing is important.

Attackers often move quickly after a critical vulnerability is publicly disclosed. Once technical information becomes available, vulnerable systems can become targets for automated scanning and exploitation.

This is why organizations should treat newly disclosed critical vulnerabilities differently when there is evidence of active exploitation.

The Attack Does Not Stop After Initial Exploitation

One of the most important lessons from this campaign is that exploiting the vulnerability may only be the first step. Researchers observed attackers creating malicious cron jobs after gaining access. Cron is a legitimate Linux scheduling mechanism. Administrators commonly use it to run scripts and commands automatically. Attackers can abuse the same functionality to establish persistence. For example, a malicious cron entry can be configured to automatically execute a command or tool, allowing an attacker to maintain access to a compromised system. This means that simply installing a security update may not be enough if the system was already compromised.

Patching removes the vulnerability. It does not necessarily remove an attacker's existing foothold.

Why Is Reverse SSH a Concern?

Another notable element of the observed attacks is the use of reverse SSH. Reverse SSH allows a compromised system to initiate an outbound SSH connection to a remote system. From an attacker's perspective, this can provide a reliable communication channel back to infrastructure they control. This is particularly interesting from a security monitoring perspective because many organizations focus heavily on suspicious inbound traffic. An attacker using reverse SSH can instead establish communication by having the compromised system connect outward. However, security teams should not automatically treat every instance of reverse SSH as malicious. There are legitimate administrative and remote-access scenarios where similar techniques may be used.

The concern becomes much greater when reverse SSH is found together with:

• An unpatched VMware vCenter Server

• Unauthorized software or binaries

• Unexpected cron jobs

• Unknown external IP addresses

• Unusual outbound SSH connections

• Suspicious process execution

• Evidence of exploitation

When these indicators appear together, the system should be investigated for potential compromise.

Why VMware vCenter Is a High-Value Target

VMware vCenter is more than just another server in the infrastructure. It provides centralized management and visibility across VMware environments, including virtual machines, hosts, clusters and other infrastructure components. That makes it an attractive target for threat actors.

If an attacker compromises vCenter, they may be able to learn how an organization's virtual environment is structured and identify systems that could be valuable for further attacks.

Potential risks include:

• Infrastructure reconnaissance

• Identification of critical virtual machines

• Discovery of configurations and services

• Persistence

• Lateral movement

• Targeting of sensitive workloads

• Disruption of virtual infrastructure

For this reason, VMware vCenter security should be treated as a critical part of an organization's overall security strategy.

Another Critical VMware vCenter Vulnerability Is Also Being Scanned

CVE-2026-59310 is not the only recent VMware vCenter vulnerability receiving attention.

Broadcom's July 29, 2026 security advisory also addresses CVE-2026-59309, another critical vCenter vulnerability with a CVSS score of 9.8. CVE-2026-59309 is an authentication-bypass vulnerability in VMware Directory Service.

Security researchers have separately reported increased scanning activity targeting VMware vCenter, including reconnaissance involving the /sdk/ endpoint and the vCenter SAML SSO flow. At this stage, the observed scanning activity should not automatically be attributed to the same threat actor associated with the confirmed CVE-2026-59310 compromises. For defenders, however, attribution is not the immediate priority.

The important questions are:

Is your VMware vCenter Server vulnerable?

Has it been patched?

Was it exposed while vulnerable?

Are there any signs that an attacker already gained access?

What Organizations Should Do Now

1. Patch VMware vCenter Immediately

Organizations should identify all VMware vCenter Server instances in their environment and apply the appropriate security updates from Broadcom.

Broadcom lists fixes for affected vCenter releases, including:

• vCenter 9.1.x: 9.1.0.0300

• vCenter 9.0.x: 9.0.2.0100

• vCenter 8.0: 8.0 U3k

Broadcom also provides corresponding remediation guidance for affected VMware Cloud Foundation and Telco Cloud deployments. Organizations should consult the official advisory and response matrix for their specific environment.

2. Do Not Assume Patching Means the Incident Is Over

If the vCenter Server was vulnerable before the patch was installed, security teams should investigate whether it was already compromised.

Look for evidence of:

• Unauthorized processes

• Unexpected files

• Modified cron jobs

• Unknown SSH connections

• Suspicious outbound traffic

• Unusual DNS requests

• Unexpected administrative activity

A patched system can still contain persistence established during the period when it was vulnerable.

3. Review Cron Jobs

Check for newly created or modified cron entries.

Pay particular attention to jobs that:

• Execute unfamiliar binaries

• Run scripts from unusual locations

• Connect to external IP addresses

• Launch SSH-related tools

• Download files

• Execute commands that are not part of normal administration

4. Monitor Outbound SSH Traffic

Review network telemetry for unexpected outbound SSH connections originating from VMware vCenter systems.

For example:

vCenter Server → External IP → SSH

An unfamiliar destination should be investigated, particularly if the connection appeared after the server was exposed to CVE-2026-59310.

5. Look for Reverse SSH and Tunneling Tools

Security teams should search process, file and network telemetry for unauthorized instances of reverse_shh or other tunneling utilities. Again, the presence of a tool alone does not prove malicious activity. The surrounding context matters.

A useful investigation should correlate:

Process + User + Time + Destination + Vulnerability Exposure

This can help distinguish legitimate administration from potential post-compromise activity.

6. Review Historical Logs

If a vCenter Server was unpatched during the period of active exploitation, review historical logs and network telemetry.

Look for:

• Suspicious HTTP requests

• Path traversal indicators

• Unexpected authentication activity

• New processes

• Unauthorized file modifications

• New cron jobs

• Unusual outbound connections

• Unexpected DNS requests

The objective is not simply to determine whether the vulnerability existed.

The objective is to determine whether someone exploited it.

What SOC Teams Should Monitor

Organizations operating a SOC, SIEM or MDR service should consider dedicated monitoring for VMware vCenter.

Useful detection scenarios include:

Suspicious File Access

vCenter → unusual path traversal request

Persistence

vCenter → new or modified cron job

Remote Access

vCenter → unexpected outbound SSH

Potential Tunneling

vCenter → reverse_ssh execution

Unusual External Communication

vCenter → previously unseen external domain/IP

Possible Post-Exploitation Activity

vCenter → suspicious process → outbound connection

The real value comes from correlating these events.

For example:

Vulnerable vCenter → suspicious request → new cron job → reverse_ssh execution → outbound connection

is far more concerning than any single event viewed on its own.

Why Continuous Monitoring Matters

The CVE-2026-59310 campaign highlights a simple but important point:

Vulnerability management and security monitoring cannot operate in isolation.

Organizations often ask:

“Have we patched the vulnerability?”

That is important, but it is only the beginning.

Security teams should also ask:

Was the system vulnerable?

Was it exposed?

Was there suspicious activity while it was vulnerable?

Did an attacker establish persistence?

Is the system communicating with infrastructure it normally should not contact?

This is where vulnerability management, threat intelligence, SOC monitoring and incident response need to work together.

How GTIS Can Help

At GTIS (GlobalTech & InfoSec Pvt. Ltd.), we help organizations identify security weaknesses, assess exposure and strengthen their ability to detect and respond to cyber threats.

Our cybersecurity and compliance capabilities include:

• Vulnerability Assessment and Penetration Testing (VAPT)

• Managed Security Services

• SOC and SIEM Monitoring

• Managed Detection and Response (MDR)

• Threat Intelligence

• Cloud Security

• Security Risk Assessment

• PCI DSS Compliance

• ISO 27001 Consulting

For organizations running VMware infrastructure, security assessments should go beyond checking whether a patch has been installed.

A stronger approach combines vulnerability assessment, configuration review, network monitoring, threat intelligence and detection of post-exploitation activity.

Final Takeaway

CVE-2026-59310 is no longer simply a critical VMware vCenter vulnerability on a security advisory list. It is being actively exploited.

The reported attacks demonstrate why organizations need to think beyond patching.

An attacker who successfully exploits a vulnerable vCenter Server may attempt to establish persistence, maintain remote access and use the compromised system as a starting point for further activity.

If your organization uses VMware vCenter Server, the priority should be:

Patch → Investigate → Monitor → Respond

And if the system was exposed before it was patched, do not assume that installing the update means the investigation is finished.

The vulnerability may be fixed. The attacker may not be.

About GTIS

GTIS (GlobalTech & InfoSec Pvt. Ltd.) is a cybersecurity and compliance company providing VAPT, vulnerability management, SOC, MDR, threat intelligence, compliance and security risk management services.

Our focus is to help organizations move beyond simply identifying vulnerabilities and build the ability to detect, investigate and respond to real-world cyber threats.

Stay patched. Stay monitored. Stay prepared.

Official Security Advisory

For affected versions and the latest remediation information, organizations should refer to Broadcom's official VMSA-2026-0006 security advisory.