VMware vCenter CVE-2026-59310: 361 Servers Breached Across 47 Countries. Patch Before This Weekend.

CVE-2026-59310 exploits the VMware vCenter Syslog server's failure to sanitize file path inputs. The Syslog service accepts configuration or log data with a path component that, under normal operation, should be confined to the Syslog service's working directory on the vCenter appliance. The vulnerability exists because the path is not validated before use: an attacker can supply sequences like ../../ or URL-encoded equivalents to traverse outside the Syslog directory and target any location the vCenter service account has write access to.

The attack chain proceeds in three steps. First, the attacker sends a crafted unauthenticated HTTP request to the vCenter Syslog service endpoint with a malicious path component. No credentials, no prior access, and no user interaction are required. Second, the traversal payload writes a malicious file (typically a shell script or a compiled binary) to a directory where it will either execute automatically or can be invoked by a subsequent request. Third, code execution is achieved under the vCenter service account's context, which has broad privileges over the vCenter appliance and its connected ESXi infrastructure.

Post-exploitation behavior in confirmed CVE-2026-59310 incidents follows a consistent two-stage persistence pattern. Attackers first install a cron job in the vCenter appliance's crontab that executes at startup and at regular intervals, ensuring the foothold survives a reboot. They then deploy reverse_ssh, an open-source tunneling tool that creates an outbound SSH connection to attacker-controlled infrastructure, so the backdoor channel is maintained even when the vCenter management interface is behind a firewall that blocks inbound connections.

The companion flaw CVE-2026-59309 (CVSS 9.8), an authentication bypass in the vCenter Directory Service, was patched in the same VMSA-2026-0006.1 advisory and is under separate scanning activity. If CVE-2026-59309 is combined with CVE-2026-59310, an attacker can bypass authentication to gain administrative access before triggering the RCE.

QUIRSO's incident response team began tracking the CVE-2026-59310 exploitation campaign after responding to a customer compromise on August 3, 2026. By analyzing victim vCenter servers reaching out to common attacker-controlled IP infrastructure, QUIRSO identified 361 confirmed victim IP addresses across 47 countries by August 7, 2026. The campaign's daily escalation tells its own story: 5 initial victims on August 3, 151 new victims on August 4 alone, and 343 of the 361 total victims confirmed within the first three days.

Germany, the United States, Turkey, Iran, and France together account for over 50 percent of confirmed victim IPs. The remaining victims are spread across 42 additional countries, spanning enterprise, government, healthcare, and critical infrastructure sectors. Because QUIRSO identified victims by their outbound connections to attacker infrastructure, the 361 figure represents confirmed compromises with active reverse_ssh connections, not the total population of vCenter servers the attacker scanned or exploited and then abandoned.

Attribution analysis points to an advanced persistent threat actor. QUIRSO noted that while timing correlation with the July 29 patch disclosure suggests the attacker used the patch as their initial exploitation signal, the uniformity of post-exploitation tooling (identical cron persistence mechanisms, the same reverse_ssh build, and consistent C2 connection patterns) suggests a disciplined operation with pre-positioned tooling rather than opportunistic scanning. Specific threat actor attribution has not been confirmed publicly.

The parallel scanning activity against CVE-2026-59309 (the companion auth bypass flaw in the same advisory) suggests the attacker may also be chaining both vulnerabilities where CVE-2026-59309 grants administrative access and CVE-2026-59310 delivers RCE to establish the reverse_ssh foothold.

Every organization running VMware vCenter Server 8.0, 9.0.x, or 9.1.x without the VMSA-2026-0006.1 patches is at risk. The vulnerability requires only network access to the vCenter management interface. No administrative credentials, existing session, or internal network position is required. Any vCenter server reachable from the internet is at extreme risk. Even vCenter servers restricted to internal management networks remain vulnerable to any attacker who achieves network-level access through phishing, VPN compromise, or lateral movement from an internet-facing system.

vCenter's role as the management plane for entire virtualization estates makes it a target of outsized value. Compromise of a single vCenter server gives an attacker administrative visibility over every ESXi host under management, every running virtual machine and its stored credentials, and the vSphere management network where backup agents, storage arrays, and other critical infrastructure components communicate. This is why APT actors prioritize vCenter over individual endpoints.

Industries with the highest exposure are those that depend heavily on VMware vSphere for production workloads: financial services, healthcare, manufacturing, government, and managed service providers. MSPs running multi-tenant vCenter deployments face compounded risk: a single compromised vCenter instance can expose every customer environment hosted on that infrastructure.

Organizations using VMware Cloud Foundation should note that CVF 5.x requires an async patch delivery process through the Broadcom support portal rather than standard VAMI patching. Check your CFV version and confirm the async patch path before attempting remediation. The JetBrains TeamCity CVE-2026-63077 unauthenticated RCE patched this same week is another CVSS 9.8 pre-authentication flaw under active exploitation. If your organization runs TeamCity on-premise alongside vCenter, treat both as this weekend's mandatory patches.

Two behavior-based rules target the malicious cron job installation step and the outbound SSH shell execution used to establish reverse_ssh tunnels after CVE-2026-59310 exploitation.

• Log sources: Linux process creation telemetry and cron audit logs from vCenter appliances and ESXi hosts
• Cron modification rule: Fires when crontab is invoked with a path pointing to /tmp/ — the pattern in confirmed CVE-2026-59310 compromises
• SSH shell invocation rule: Catches reverse_ssh invocations with shell execution parameters, indicating active C2

Run retroactive queries against August 3-14 telemetry from vCenter appliances and ESXi management hosts before deploying forward-looking alerts. QUIRSO's generic reverse_ssh YARA rule at github.com/QUIRSO/QTRDetectionContent provides binary-level detection and should be deployed alongside these rules.

Specific C2 IP addresses for the CVE-2026-59310 campaign have not been released publicly, as QUIRSO is coordinating with law enforcement. Detection must therefore rely on behavioral indicators rather than IP blocklists. The three primary hunting surfaces are process telemetry from the vCenter appliance, crontab modification events, and outbound network connections from the vCenter host.

Hunt for unexpected processes named reverse_ssh or ssh with outbound connections on the vCenter appliance. Any binary dropped to /tmp/ or /var/tmp/ on the vCenter appliance that executes with network connectivity is a strong compromise indicator. vCenter appliances should have a predictable and minimal process set; any deviation warrants investigation.

Crontab entries are the persistence mechanism. Check /etc/cron.d/, /var/spool/cron/, and /etc/cron.hourly/ for any entries added or modified after July 29, 2026 that reference external paths, /tmp/ directories, or base64-encoded commands. The malicious cron entry in confirmed incidents ensures reverse_ssh relaunches after each reboot.

For the companion CVE-2026-59309 (auth bypass in vCenter Directory Service, same advisory), hunt for new administrative user accounts created after July 29, unexpected LDAP queries to the vCenter identity sources, and any changes to vCenter permission assignments since that date. The Progress LoadMaster CVE-2026-8037 root RCE active this week follows a parallel attack pattern of unauthenticated command injection on an internet-facing management appliance. Review that post if your environment includes LoadMaster instances alongside vCenter.

Broadcom confirmed no workaround or mitigation exists for CVE-2026-59310. The only remediation is applying the VMSA-2026-0006.1 patches. If you cannot patch immediately, restrict network access to the vCenter management interface to a dedicated management VLAN reachable only from jump hosts; this does not eliminate risk but reduces the attack surface to internal adversaries rather than internet-facing threats.

VMware vCenter CVE-2026-59310 is a management plane attack, and management plane attacks have a different blast radius than endpoint compromises. An attacker with a persistent reverse SSH tunnel to your vCenter server has read-write access to every virtual machine your organization runs: they can take snapshots of running systems to extract credentials and data at rest, power off production workloads, deploy ransomware as VM disk images across all hosted VMs simultaneously, and pivot to ESXi hosts to compromise the hypervisor layer itself.

The 361 confirmed victims represent organizations that had not applied a patch Broadcom released 5 to 11 days earlier. This is not a zero-day situation. A patch existed on July 29. Exploitation began on August 3. Every organization that patches this weekend avoids joining a list that grew by 151 entries in a single day.

The APT-consistent post-exploitation behavior observed by QUIRSO (a disciplined persistence mechanism, a specific reverse_ssh tool, and coordinated C2 infrastructure) suggests this campaign is not ransomware-focused. The most likely objectives are persistent network access for long-term espionage, credential harvesting across the virtualization estate, or pre-positioning for a disruptive strike against critical infrastructure. The longer an unpatched vCenter remains connected, the higher the probability that a reverse_ssh backdoor is already installed and the attacker is present, waiting.

Patch to VMSA-2026-0006.1 before this weekend. Then hunt the IOCs above to confirm whether you were already compromised during the August 3-14 window.