Full Report
Threat actors have begun to actively exploit a recently patched critical security flaw in Broadcom VMware vCenter, according to new findings from QUIRSO. The vulnerability in question is CVE-2026-59310 (CVSS score: 9.8), a directory-traversal vulnerability in the VMware vCenter server that a malicious actor with network access can exploit to execute arbitrary code. Patches for the flaw were
Analysis Summary
# Vulnerability: Critical Directory Traversal in VMware vCenter Server
## CVE Details
- **CVE ID:** CVE-2026-59310
- **CVSS Score:** 9.8 (Critical)
- **CWE:** Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
## Affected Systems
- **Products:** Broadcom VMware vCenter Server
- **Versions:** Vulnerable versions prior to the patches released in late July 2026 (specific version numbers not listed in text, see vendor advisory VMSA-2026-0006).
- **Configurations:** Systems with network access to the vCenter management interface.
## Vulnerability Description
CVE-2026-59310 is a critical directory-traversal vulnerability. It allows a malicious actor with network access to bypass file system restrictions to read or write files. In the observed attack campaigns, this flaw is weaponized to achieve arbitrary code execution (RCE) on the underlying host.
## Exploitation
- **Status:** Exploited in the wild (Active campaign reported by QUIRSO as of August 2026).
- **Complexity:** Low (exploitable by an unauthenticated attacker with network access).
- **Attack Vector:** Network
## Impact
- **Confidentiality:** High (Total compromise of the vCenter server data).
- **Integrity:** High (Ability to execute arbitrary code and modify system files).
- **Availability:** High (Potential to disrupt virtualized infrastructure management).
## Remediation
### Patches
- Broadcom released patches for vCenter Server in late July 2026. Administrators should refer to Broadcom advisory **VMSA-2026-0006** for specific version-mapping.
### Workarounds
- The article does not specify official workarounds. Standard mitigation includes restricting network access to vCenter management interfaces (ports 443, etc.) to authorized administrative subnets only.
## Detection
### Indicators of Compromise (IoCs)
- **Persistence Mechanism:** Presence of unauthorized **cron jobs** on the vCenter host.
- **Malicious Tooling:** Execution of `reverse_ssh`, an open-source tool used for establishing outbound SSH tunnels.
- **Network Activity:** Unexpected outbound SSH connections to external, unauthorized IP addresses (specifically starting around August 3, 2026).
- **Log Patterns:** Forensic evidence of path traversal attempts in vCenter web logs.
### Detection methods and tools
- **Honeypot Monitoring:** Increased fingerprinting via `POST /sdk/ (RetrieveServiceContent)` and walks of the `/websso` SAML flow.
- **Forensic Analysis:** Audit the `/etc/crontab` and user-specific crontabs for entries related to `reverse_ssh`.
## References
- Broadcom Security Advisory: VMSA-2026-0006
- QUIRSO Findings: hxxps[://]medium[.]com/@quirso_de/active-exploitation-of-cve-2026-59310-361-victim-ips-across-47-countries-9783187cc6ff
- Original News Report: hxxps[://]thehackernews[.]com/2026/08/attackers-exploit-vmware-vcenter.html