CISA: Critical VMware RCE flaw now exploited by ransomware gangs
CISA warns ransomware gangs now exploit critical VMware vCenter syslog RCE CVE-2026-59310, already KEV-listed after APT compromises across 47 countries.
Broadcom patched critical directory traversal flaw CVE-2026-59310 in the vCenter Syslog server on July 29, warning of unauthenticated remote code execution. QUIRSO subsequently found 361 compromised IPs across 47 countries after a suspected APT deployed a reverse SSH tool for persistence and remote access. CISA added the flaw to its KEV catalog with a three-day patch deadline for federal agencies, and over the weekend updated it to flag active abuse by ransomware gangs. Shadowserver tracks over 450 exposed vCenter servers, and CISA has tagged 26 VMware vulnerabilities as exploited in the wild over five years, nine abused by ransomware.
- CVE-2026-59310: critical unauth directory traversal RCE in vCenter Syslog server, patched July 29
- Suspected APT compromised 361 IPs in 47 countries using reverse SSH persistence
- KEV catalog updated to flag active ransomware gang exploitation
- Over 450 vCenter servers currently exposed online per Shadowserver
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-37079 | Out-of-bounds Write in Broadcom VMware vCenter Server DCERPC Enables RCE | 9.8 | 22% | KEV | KEV |
| CVE-2025-22225 | Sandbox Escape via Arbitrary Kernel Write in VMware ESXi (Actively Exploited) | 8.2 | 1% | KEVRansomware | KEV |
| CVE-2025-60710 | Link Following Privilege Escalation in Microsoft Windows Host Process for Tasks | 7.8 | 5% | KEVRansomware | KEV |
| CVE-2026-22719 | Unauthenticated Command Injection RCE in Broadcom VMware Aria Operations | 8.1 | 18% | KEV | KEV |
| CVE-2026-59310 | Unauthenticated Path Traversal RCE in Broadcom VMware vCenter Server Syslog | 9.8 | 3% | KEVRansomwarePoC ×2 | KEV |
From the original article
2 min read at bleepingcomputer.com
The U. S. Cybersecurity and Infrastructure Security Agency (CISA) warned security teams that ransomware gangs have now joined ongoing attacks exploiting a critical VMware vCenter vulnerability patched in July.
By Sergiu Gatlan · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.