CVE-2026-59310 is a path-traversal vulnerability in VMware vCenter with a CVSS score of 9.8. Broadcom patched it on July 29, 2026. Exploitation in the wild began on August 3, five days later. As of the latest telemetry, 361 unique IP addresses across 47 countries have been compromised.
This is not a slow-burn campaign. This is a racing exploitation window, and the numbers show many organizations are still behind on hypervisor patching.
What the vulnerability does
CVE-2026-59310 allows an unauthenticated attacker with network access to the vCenter server to traverse the directory structure and execute arbitrary code. No credentials required. No user interaction needed. If your vCenter is reachable from the internet or from a compromised network segment, an attacker can own it remotely.
How the attackers are operating
A German incident response firm assessed with moderate confidence that the campaign is operated by a Chinese-speaking threat actor. The attribution is based on three independent indicators: Chinese-language artifacts embedded in the attacker's scripts, reuse of tradecraft documented in Chinese-language security publications, and use of Chinese-language tooling.
The attack chain follows a consistent pattern. After successful path traversal, the actor writes a malformed cron file to disk, executes a curl command to retrieve a backdoor, and removes the log file. The backdoor is reverse_ssh, an open-source tool that establishes a persistent outbound SSH tunnel to attacker-controlled infrastructure. The cron job survives restarts.
In follow-on intrusions, the actor has deployed ransomware derived from the Babuk family, encrypting data after establishing a foothold.
One detail worth noting: attacker-controlled command-and-control domains appear to have been pre-staged before Broadcom published the patch. This suggests the actor may have had access to information about the vulnerability before public disclosure.
What to do right now
If you are running VMware vCenter, apply the Broadcom patch for CVE-2026-59310 immediately. If you cannot patch right now, isolate the vCenter management interface from any internet-facing network segment and restrict access to a dedicated management VLAN with enforced IP allowlisting.
If your vCenter was internet-accessible in the window between July 29 and today without the patch applied, do not assume you are clean. Check for:
- Unusual cron jobs, particularly files with names resembling zz-poc59310-syslog.log
- Unexpected curl or wget processes spawned by the cron daemon
- Outbound SSH connections to unknown infrastructure
- Evidence of lateral movement from the vCenter host
Hypervisor management interfaces are the highest-value target in most enterprise environments. A compromised vCenter gives an attacker access to every VM on the host. This is not a patch-when-convenient situation.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you want help assessing your vCenter exposure or hypervisor management posture.