Ransomware gangs move onto the vCenter Syslog bug Broadcom patched on July 29
CVE-2026-59310 gave a suspected APT crew persistence on vCenter systems in August. CISA has now flagged the same directory traversal as abused by ransomware operators. Broadcom patched it on July 29.
The Watch · Security desk
What happened
- Digital forensics firm QUIRSO reported two weeks later that a suspected APT actor had compromised more than 361 IP addresses across 47 countries, planting a reverse SSH tool for persistence and remote access.
- CISA added the flaw to its Known Exploited Vulnerabilities catalog days after that report and ordered government agencies to secure their vCenter systems within three days.
- CISA updated the same catalog over the weekend to mark CVE-2026-59310 as actively abused by ransomware gangs, and has not published details of those attacks.
Why it matters
- Who's exposed exposure One unauthenticated request against the management plane can put an entire virtual estate in scope for encryption, and an affiliate who lands on vCenter does not have to hunt laterally for where the data sits.
- Who has to decide decision Anyone who deferred the vCenter reboot in July on the reasoning that espionage targeting is selective now has to schedule it against opportunistic crews who encrypt whatever they reach.
- What it sets up precedent On CISA's own tally, roughly a third of exploited VMware bugs end up in ransomware hands, so the sensible default for a pre-auth VMware flaw is to plan for encryption from day one rather than wait for the catalog to confirm it.
- What it limits constraint Patch state for vCenter is not disclosed, so a defender sizing the wider exposure works from a count of internet-facing servers and cannot tell how many of them are fixed.
Next story · Security · Oct 9
Honeypots log exploitation attempts against SonicWall SMA1000 flaw three days after patchConfirmed7 publishers
The flaw is a directory traversal in the vCenter Syslog server, and Broadcom's description says an unauthenticated attacker can use it to execute arbitrary code [1]. vCenter sits above the ESXi estate. A compromised vCenter or ESXi server can hand an intruder access to an organisation's network and to data held on internal systems [8], and multiple ransomware crews have built encryptors specifically for VMware virtual machines, because that is where enterprises keep corporate data [9].
QUIRSO's report came about two weeks after the July 29 patch, so around August 12, and CISA's catalogue entry followed within days. Roughly three weeks separated the fix from a three-day remediation deadline for federal agencies [15].
Shadowserver currently tracks more than 450 vCenter servers exposed online [7]. QUIRSO's compromised-host count is about 80 per cent of that exposed population [14]. The two figures measure different things at different times, and both readings are uncomfortable: either far more vCenters were reachable in August than a scan finds now, or a large share of the hosts QUIRSO identified have since come off the public internet.
The pattern around VMware is established. CISA has tagged 26 VMware vulnerabilities as exploited in the wild over the last five years, and nine of those were also abused by ransomware operations [12], about one in three [13]. In February the agency said ransomware groups had begun exploiting the ESXi sandbox escape CVE-2025-22225, a bug Chinese-speaking threat actors had used in zero-day attacks since at least February 2024 [10]. It flagged VMware Aria Operations (CVE-2026-22719) and vCenter Server (CVE-2024-37079) as exploited in February and March [11].
Broadcom's instruction has not changed since July. The supplemental FAQ published with the fix told customers to treat CVE-2026-59310 as an emergency and install patches as soon as possible [2]. The weekend update changes who arrives next on an unpatched host. A reverse SSH implant is a persistence problem found on review [3]; an affiliate with a VMware encryptor runs it on first access [9].
What to watch
- Whether CISA names the ransomware groups or publishes post-exploitation indicators for CVE-2026-59310.
- Whether Shadowserver's exposed vCenter count moves, and whether anyone publishes patch-state data for the population.
- Whether the reverse SSH access QUIRSO found on 361 hosts turns up in ransomware intrusions, which would tie the two waves together.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+15
- Incentives40
- Confidence65
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Broadcom addressed CVE-2026-59310 on July 29, describing it as a critical directory traversal vulnerability in the vCenter Syslog server that unauthenticated attackers can exploit to execute arbitrary code.
- [2]
Broadcom warned customers in a supplemental FAQ at the time to treat fixing CVE-2026-59310 as an emergency and install patches as soon as possible.
- [3]
Two weeks after the patch, digital forensics and incident response company QUIRSO reported finding over 361 IP addresses across 47 countries compromised after a suspected advanced persistent threat actor began exploiting the vulnerability to deploy a reverse SSH tool for persistence and remote access.
- [4]
Days after the QUIRSO report, CISA added CVE-2026-59310 to its Known Exploited Vulnerabilities catalog and ordered government agencies to secure their vCenter systems within three days.
- [5]
Over the weekend, CISA updated its KEV catalog again to flag CVE-2026-59310 as actively abused by ransomware gangs.
- [6]
CISA has yet to share any details about the ransomware attacks targeting the vulnerability.
- [7]
Internet security threat monitor Shadowserver currently tracks over 450 VMware vCenter servers exposed online, and there is no information on how many have already been patched against this flaw.
- [8]
VMware servers are commonly targeted because compromised vCenter or ESXi servers can provide access to an organization's network and sensitive data stored on internal systems.
- [9]
In recent years, multiple ransomware gangs have developed dedicated encryptors to target VMware virtual machines, as enterprise organizations now commonly use them to manage and store corporate data.
- [10]
CISA warned in February that ransomware groups began exploiting a VMware ESXi sandbox escape vulnerability (CVE-2025-22225), which Chinese-speaking threat actors have targeted in zero-day attacks since at least February 2024.
- [11]
Since the start of the year, CISA has flagged VMware Aria Operations (CVE-2026-22719) and VMware vCenter Server (CVE-2024-37079) flaws as exploited in attacks in February and March.
- [12]
Over the last five years, CISA has tagged 26 VMware vulnerabilities as exploited in the wild, nine of them also abused by ransomware operations.
- [13]
Nine of 26 exploited VMware vulnerabilities is about 35 per cent, roughly one in three.
- [14]
QUIRSO's count of more than 361 compromised IP addresses is about 80 per cent of the 450-plus exposed vCenter servers Shadowserver currently tracks.
- [15]
About three weeks separated Broadcom's July 29 fix from CISA's KEV listing and its three-day federal deadline: the QUIRSO report landed two weeks after the patch, around August 12, and the KEV entry followed days later.
Sources
2 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comCISA: Critical VMware RCE flaw now exploited by ransomware gangs
1 article · September 15, 2026
- scworld.comPatched VMware vCenter bug targeted in ransomware campaigns
1 article · September 15, 2026