Press play to start listening
A major cyberattack is currently hitting organizations worldwide that run VMware vCenter, a popular management tool used by network administrators.
According to QUIRSO’s Threat Research team, affected vCenter systems first connected to the attacker’s infrastructure on August 3, five days after Broadcom initially disclosed the flaw in VMSA-2026-0006 on July 29. QUIRSO assesses the operator as a suspected APT actor.
A Rapidly Spreading Threat
QUIRSO observed 151 additional victim IP addresses on August 4. By August 5, 343 of the eventual 361 addresses, approximately 95%, had appeared. While researchers said prior knowledge was possible, they found the timing more consistent with Broadcom’s disclosure serving as the campaign’s starting point.
The five countries with the largest numbers of identified victim IP addresses were:
- Germany
- United States
- Turkey
- Iran
- France
These countries accounted for 185 of the 361 identified IP addresses, or just over half of the observed victim infrastructure. However, researchers explained that the figures don’t represent 361 separate companies since one IP address may not represent a single victimized company because many addresses are shared by cloud services and web hosting providers.
How the Attacks Work
The vulnerability being exploited is tracked as CVE-2026-59310. It is a critical directory-traversal bug inside the VMware vCenter Syslog server that handles system event logs. Directory traversal, for your information, is a system flaw that lets unauthorized users trick software into opening restricted folders.
According to Broadcom’s advisory, an attacker with network access to vCenter can exploit CVE-2026-59310 to execute arbitrary code without authentication. Because vCenter manages ESXi hosts and virtual machines, compromising the server could place the wider virtual environment at risk. Broadcom assigned the flaw a CVSS score of 9.8 out of 10.
Following compromise, QUIRSO observed the attacker deploying reverse_ssh as a persistence and remote-access mechanism. reverse_ssh is an open-source SSH-based reverse-shell framework that can establish an outbound connection from a compromised system back to an operator-controlled server.
Such connections can be useful to attackers because security controls may be more heavily focused on unsolicited inbound connections. The resulting outbound connection may bypass controls designed mainly to block unsolicited inbound traffic, helping the attacker retain remote access
However, reverse_ssh is a legitimate dual-use security tool, and its presence alone doesn’t prove that a system has been compromised, unless it is combined with an unauthorized installation, unexpected outbound connections, or execution on a vulnerable vCenter appliance.
What Server Managers Need to Do
Broadcom warned that there is no workaround to stop attacks without updating the software, so network admins must apply official fixes immediately. Safe software versions include:
- VMware vCenter 9.1: 9.1.0.0300
- VMware vCenter 9.0: 9.0.2.0100
- VMware vCenter 8.0: 8.0 U3k or 8.0 U2f, depending on the deployed branch.
QUIRSO released a generic YARA rule for identifying reverse_ssh builds. Because the tool has legitimate uses, a match should be investigated alongside other evidence and not treated as proof of compromise by itself.
The campaign follows earlier exploitation of VMware vulnerabilities. In March 2025, Broadcom reported that CVE-2025-22224 had been exploited in the wild and could allow an attacker with administrative access inside a virtual machine to execute code as its VMX process on the host.
Expert Commentary:
In comments shared with Hackread.com, security experts stressed the danger of leaving vCenter servers exposed.
“Directory traversal vulnerabilities allow attackers to break out of intended file system boundaries and access resources they should never reach. CVE-2026-59310 is especially concerning because it affects VMware vCenter, a high-value management platform that sits at the center of many enterprise virtual environments,” said Robert Coles, Senior Manager of Threat Intelligence Security at Black Duck.
“Security teams should not only patch quickly but also ensure vCenter is never directly exposed to the internet. When exploitation leads to compromise of a management platform like vCenter, the impact can extend far beyond a single system,” he advised.
Jason Soroko, Senior Fellow at Sectigo, highlighted that applying updates is only half the battle, stating, “A directory traversal flaw is a failure to keep a file request inside the folder that an application is supposed to use. By supplying path elements such as ../, an attacker can make the application move up the directory tree and reach files or locations outside that boundary.”
“In CVE-2026-59310, the affected component is vCenter’s Syslog server, and Broadcom says an attacker with network access can turn the path-handling error into arbitrary code execution. The key point is that this is not limited to reading a file,” Jason emphasised.
“A service intended to collect logs can become a route into the operating system. Broadcom assigned the flaw a CVSS score of 9.8 and provides no workaround, which makes installation of a fixed version the required remedy.”
