Critical vCenter Flaw Exploited Within Days of Disclosure
Attackers wasted no time. A critical VMware vCenter vulnerability was exploited just five days after Broadcom published its advisory. The campaign used an open-source reverse shell to keep access to compromised systems.
German digital forensics firm Quirso uncovered the activity during an incident response engagement. Its findings, released on August 10, point to a suspected advanced persistent threat (APT) actor. Quirso counted 361 victim IP addresses across 47 countries, though it cautioned that an IP address doesn’t always equal a single organization.
The vulnerability, tracked as CVE-2026-59310, is a critical directory traversal flaw in the vCenter Syslog server. It carries a CVSS score of 9.8. Broadcom said an unauthenticated attacker with network access to vCenter can exploit it to execute arbitrary code. That turns a service built to collect logs into a direct route into the operating system.
For more on VMware-related threats, see Play Ransomware Expands to Target VMware ESXi Environments.
Five Days From Advisory to Compromise
Broadcom released its advisory on July 29. At that point, it said it had not observed any exploitation. The advisory was revised on August 3 to include 8.0 U2f express patches.
Quirso’s team first noticed compromised systems contacting attacker infrastructure on August 3. The next day brought 151 more victim IPs. By August 5, roughly 95% of the total 361 had appeared. Germany, the United States, Turkey, Iran, and France accounted for 185 of them.
The correlation between disclosure and exploitation is striking. While the attacker may have had prior knowledge of the flaw, Quirso believes the advisory likely served as the campaign’s starting point.
Two Clocks to Manage
For persistence, the attackers deployed reverse_ssh, an open-source SSH-based reverse shell framework built for penetration testing. Because it dials outward rather than accepting inbound connections, it can bypass controls designed to block unsolicited inbound access. Quirso stressed that its presence alone does not prove compromise.
Jason Soroko, senior fellow at certificate lifecycle management provider Sectigo, said patching alone won’t resolve the incident. “There are therefore two clocks to manage,” he said. One for closing the vulnerability, and another for evicting anyone who entered before the patch was applied.
What to Check Right Now
- Look for outbound SSH connections from vCenter servers to unknown IPs.
- Review logs for unusual activity around August 3–5, 2026.
- Check for the presence of reverse_ssh binaries or related processes.
- Assume compromise if any indicators are found, and initiate incident response immediately.
Patch Availability and Workarounds
Broadcom has not published a workaround. Fixed vCenter releases are 9.1.0.0300, 9.0.2.0100, and 8.0 U3k or 8.0 U2f depending on the deployed branch. These address both critical flaws in the advisory: the exploited directory traversal and an authentication bypass in VMware Directory Service.
If you haven’t patched yet, do it now. The window between disclosure and exploitation is shrinking, and this campaign shows how quickly attackers move.
For more on securing your infrastructure, read about VMware vCenter vulnerability remediation steps and how to detect reverse shells in your environment.
