CISA: Critical VMware RCE flaw now exploited by ransomware gangs
CISA warns ransomware gangs now exploit critical VMware vCenter syslog RCE CVE-2026-59310, already KEV-listed after APT compromises across 47 countries.
90
CVE-2026-59310
Unauthenticated Path Traversal RCE in Broadcom VMware vCenter Server Syslog
CISA: Broadcom VMware vCenter Path Traversal Vulnerability
- CVSS 3.1
- 9.8 critical
- EPSS
- 3%p85
- Published
- ·
- Added to KEV
AI analysisSummaries by Vani AI
CVE-2026-59310 is a directory traversal (CWE-22) vulnerability in the Syslog server component of VMware vCenter Server, rated critical at CVSS 9.8. It can be triggered over the network without authentication or user interaction, allowing a malicious actor with network access to vCenter to achieve arbitrary code execution. An attacker who exploits it gains code execution on the vCenter appliance, and reported campaigns show it has been used to establish persistent remote access and, by a suspected China-nexus actor, to deploy Babuk ransomware. Any organization running an affected version of vCenter Server is exposed, especially where the management interface is reachable from the internet; the available data does not specify affected version ranges. Exploitation is confirmed in the wild: CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-08-18, it was reportedly exploited just five days after disclosure, and EPSS estimates a 45.9% probability of exploitation within 30 days (99th percentile).
What to do: Upgrade vCenter Server to the patched release identified in Broadcom's advisory (no specific version ranges are provided in this data) and prioritize any vCenter that is internet-facing, in line with CISA KEV and BOD 26-04 requirements for federal agencies. Until patched, restrict access to the vCenter management interface to trusted networks and verify whether the vCenter Syslog server is enabled. Hunt for compromise indicators, including unexplained remote-access persistence and Babuk ransomware artifacts, given the documented China-nexus exploitation.
| Product | Affected |
|---|---|
| Broadcom (VMware) vCenter Server | — |
Estimated exposure
largeApproximately 50,000-100,000 internet-exposed vCenter Server instances, with total deployments (including internal-only) likely in the hundreds of thousands — vCenter is the dominant enterprise vSphere management platform, and public internet scan counts during previous vCenter vulnerability campaigns have consistently reported tens of thousands of exposed instances, with internal-only…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.
KEVCISA Known Exploited Vulnerability
- Affected
- Broadcom VMware vCenter
- Required action
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Due date
- Ransomware use
- Known
In the news
14 storiesAttackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access
Attackers actively exploit critical VMware vCenter flaw CVE-2026-59310, installing reverse_ssh backdoors on 361 hosts across 47 countries.
88
Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation
CISA added four critical actively exploited flaws to KEV: macOS Screen Sharing, SharePoint, VMware vCenter, and Microsoft IKE, with APT and ransomware use.
86
U.S. CISA adds Apple macOS, Microsoft SharePoint, Broadcom VMware vCenter, and Microsoft IKE flaws to its Known Exploited Vulnerabilities catalog
CISA adds actively exploited flaws in Microsoft IKE, SharePoint, VMware vCenter, and macOS Screen Sharing to KEV catalog, due August 21.
80
Three Critical VMware Flaws Allow Auth Bypass, Code Execution, and VM Escape
Broadcom patches three critical VMware flaws, including vCenter auth bypass CVE-2026-59309 and an ESX VM escape, urging immediate updates.
80
Warp Panda used low-severity ESXi flaw CVE-2026-41709 as a zero-day
CISA added the logging bug to KEV and gave US federal agencies two weeks to install the patched ESXi builds.
78
Canada updates VMware advisory after two CVEs enter CISA KEV
CVE-2026-41709 joined the KEV catalog on October 28; CVE-2026-59310 was added on August 18.
78
CVE-2026-33824: CISA Flags Windows IKE RCE as Exploited
CISA added four actively exploited vulnerabilities to its KEV catalog, headlined by CVE-2026-33824, a Windows IKE Service Extensions remote code execution flaw.
78
⚡ Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and More
Weekly recap: suspected China-nexus APT exploited VMware vCenter CVE-2026-59310, Lazarus used Windows zero-day CVE-2026-68820, and macOS flaw dropped Monero miners.
78
Suspected China-Nexus Actor Exploits VMware vCenter Flaw, Deploys Babuk
QUIRSO attributes exploitation of VMware vCenter CVE-2026-59310 to a suspected China-nexus actor that hit 361 IPs in 47 countries, deploying backdoors and Babuk.
78
vCenter Flaw Exploited Just Five Days After Disclosure
Attackers began exploiting critical vCenter flaw CVE-2026-59310 five days after Broadcom's disclosure, putting enterprise VMware deployments at risk.
78
Critical VMware Workstation and Fusion Flaw Lets VM Admins Execute Host Code
Broadcom patched two VMware Workstation and Fusion flaws, including critical integer overflow CVE-2026-59346 (CVSS 9.3), letting guest admins execute host code; no exploitation seen.
60
60
ThreatsDay: Self-Rewriting Agents, 800+ Flaws Patched, Insider SIM Swaps and 22 More New Stories
Unit 42 exposed CL-CRI-1171, a pay-per-install operation spreading OfferLoader and Insomnia RAT via YouTube and SEO poisoning to corporate and government targets.
46