Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access
Attackers actively exploit critical VMware vCenter flaw CVE-2026-59310, installing reverse_ssh backdoors on 361 hosts across 47 countries.
QUIRSO observed active exploitation of CVE-2026-59310 (CVSS 9.8), a directory-traversal flaw in VMware vCenter allowing arbitrary code execution, patched by Broadcom in late July. Attack chains deploy a malicious cron job running the open-source reverse_ssh tool for persistence, with compromised systems phoning home starting August 3, five days after disclosure. Forensics show 361 unique victim IPs in 47 countries, mostly Germany, the U.S., Turkey, Iran, and France, with the actor suspected to be an APT. Separately, Defused Cyber reports rising scanning indicative of exploitation of related CVE-2026-59309, an unauthenticated auth bypass in vmdir.
- CVE-2026-59310 (CVSS 9.8) directory traversal in vCenter under active exploitation
- Malicious cron job deploys reverse_ssh for persistent remote access
- 361 unique victim IPs across 47 countries; exploitation began five days post-disclosure
- Suspected APT actor; VMware appliances previously targeted by Chinese espionage clusters
- Scanning spike also observed for related CVE-2026-59309 auth bypass
- Threat actors
- UNC5174PurpleHaze
- Malware
- GoReShell
- Organizations
- The Hacker News
- Countries
- GermanyUnited StatesTurkeyIranFrance
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-59309 | VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service | 9.8 | 8% | ||
| CVE-2026-59310 | Unauthenticated Path Traversal RCE in Broadcom VMware vCenter Server Syslog | 9.8 | 3% | KEVRansomwarePoC ×2 | KEV |
From the original article
2 min read at thehackernews.com
Ravie Lakshmanan Aug 12, 2026 Vulnerability / Threat Intelligence Threat actors have begun to actively exploit a recently patched critical security flaw in Broadcom VMware vCenter, according to new findings from QUIRSO. The vulnerability in question is CVE-2026-59310 (CVSS score: 9.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.