Attackers exploit critical VMware vCenter flaw to plant reverse SSH backdoors

A critical VMware vCenter flaw that Broadcom patched in late July is now under active exploitation in a global campaign. Tracked as CVE-2026-59310 and scored 9.8, it is a directory-traversal bug in the vCenter Syslog server that lets an unauthenticated attacker with network access run code, turning a logging service into a route onto the host. Incident responders at QUIRSO found a single actor exploiting it from around August 3, using path traversal to drop a cron job that launches the open-source reverse_ssh tool for persistent remote access. More than 360 compromised systems across 47 countries have been identified, and patching alone will not remove an existing foothold.

Check

Apply Broadcom's vCenter update immediately if you have not, since there is no workaround, and hunt compromised hosts for unexpected cron jobs, the reverse_ssh tool, and unusual outbound SSH connections.

Affected

Organizations with network-reachable VMware vCenter on unpatched builds (CVE-2026-59310); an unauthenticated attacker can run code on the appliance, and this campaign installs a reverse SSH backdoor that survives patching.

Fix

Patch, then investigate for compromise rather than assuming the update suffices, remove any reverse_ssh persistence and rogue cron jobs, restrict vCenter access, and review logs for path-traversal requests to the syslog service.