A critical VMware vCenter flaw that Broadcom patched in late July is now under active exploitation in a global campaign. Tracked as CVE-2026-59310 and scored 9.8, it is a directory-traversal bug in the vCenter Syslog server that lets an unauthenticated attacker with network access run code, turning a logging service into a route onto the host. Incident responders at QUIRSO found a single actor exploiting it from around August 3, using path traversal to drop a cron job that launches the open-source reverse_ssh tool for persistent remote access. More than 360 compromised systems across 47 countries have been identified, and patching alone will not remove an existing foothold.
Broadcom released emergency patches for five VMware flaws, three of them critical, affecting ESXi, vCenter, Workstation, and Fusion. The most notable, CVE-2026-47876, is an out-of-bounds write in the ESXi VMXNET3 network adapter that lets an attacker with admin rights inside a guest virtual machine run code on the host, a VM escape. Two critical vCenter flaws follow: CVE-2026-59309 is an authentication bypass reachable over the network, and CVE-2026-59310, scored 9.8, allows code execution through a directory traversal. Broadcom warns the vCenter bypass could be chained with the escape or the code-execution flaw to seize the hypervisor without any guest foothold. No exploitation is reported yet.
TrustStrike Labs