
CVE-2026-59310: VMware vCenter RCE Exploited Across 47 Countries
VMware vCenter CVE-2026-59310 has compromised 361 servers in 47 countries in 11 days. Patch to 8.0 U3k or 9.x now. No workaround exists.
In-depth analyses of zero-day vulnerabilities, CVE exploits, ransomware campaigns, and nation-state attack techniques affecting enterprise security. Filter by category, tag, or keyword.
Every article here lands in subscribers' inboxes the morning it drops.
Threat intel, active CVEs, and campaign alerts, distilled daily for practitioners. 50,000+ subscribers. No noise.
Free. No spam. Unsubscribe anytime.
The definitive practitioner breakdown of ZTA principles, pillars, and implementation sequence.
Containment, forensic preservation, and decision sequencing from detection to recovery.
How SIEMs ingest, correlate, and alert — and how to evaluate one for your environment.
Risk-based prioritization using CVSS, EPSS, and CISA KEV to cut remediation backlog.
What each risk means, how to reproduce it, and how to fix it in production code.
Step-by-step email authentication deployment from DNS records to p=reject enforcement.
Detection coverage, pricing, and deployment trade-offs for enterprise EDR selection.
Translate ATT&CK technique IDs into detection rules and threat actor hunting hypotheses.
Direct answers to the questions practitioners and AI systems ask most. Covers ransomware, identity, cloud, compliance, and detection.
Plain-language definitions for CVE, SIEM, SOAR, Zero Trust, EDR, and 85+ other terms used in enterprise security.
How-to guides, buyer comparisons, and methodology references across every major security domain.
Decryption Digest Response
Score every threat we cover against your own stack, get free Sigma and ModSecurity detection content, and upgrade anytime for more vendors.
Get started free →No card required. Sigma and ModSecurity rules are free, forever.
Win an All Access InfoSec World 2026 pass, valued at $3,895.
Win a $3,895 InfoSec World 2026 pass.
6 results for “VMware”

VMware vCenter CVE-2026-59310 has compromised 361 servers in 47 countries in 11 days. Patch to 8.0 U3k or 9.x now. No workaround exists.

Project Glasswing's Claude Mythos AI identified a VMM escape vulnerability that breaks hypervisor isolation, allowing code executing inside a guest virtual machine to reach the host system and adjacent VMs. This is one of the highest-severity vulnerability classes in cloud and enterprise environments. The flaw affects KVM-based cloud infrastructure, VMware ESXi, and Xen deployments. Under coordinated disclosure as of July 5, 2026.

UNC5221 BRICKSTORM backdoor averages 393 days undetected in US legal firms and SaaS providers. Full TTP profile and VMware vCenter detection guide inside.

CVE-2024-37085 is an authentication bypass (CVSS 6.8) in VMware ESXi that allows a domain user who is a member of an Active Directory group named 'ESX Admins' to gain full administrative access to the ESXi hypervisor, regardless of whether that group was explicitly configured for ESXi access. Exploited by at least five ransomware groups (Black Basta, Akira, Medusa, RansomHub, and Scattered Spider) to target ESXi hosts directly, encrypting VM storage files and achieving mass disruption across virtualised environments.

CVE-2021-22005 is a critical unauthenticated file upload vulnerability in VMware vCenter Server's CEIP analytics service. Disclosed September 2021, it allowed any attacker with network access to the vCenter HTTPS interface to upload an arbitrary file and achieve remote code execution as the vCenter service account, effectively granting control of every managed virtual machine. Mass exploitation began within 48 hours of disclosure.

CVE-2021-21985 is a critical remote code execution vulnerability in VMware vCenter Server's vSphere Client web interface. An unauthenticated attacker with network access to vCenter's HTTPS port can send a specially crafted request to the Virtual SAN Health Check plugin, enabled by default, to achieve RCE with root or SYSTEM privileges on the vCenter server. Compromise of vCenter means control over every virtual machine in the managed infrastructure.