GhostFrame ESXi implant linked to Settra ransomware, Insikt says
The implant needs existing root access, masquerades as vmhostd, and can harvest Windows credentials from guest VMs.
Stories per day · 30 days
4 RSS
Relatedesxi6broadcom5cisa-kev4esx3credential-theft2ghostframe2insufficient-logging2kev2settra2audit-logging1banking-malware1bod-26-041cisa1cloud-foundation1dell1dll-side-loading1globalprotect1hyperarmor1
23 stories, newest first · one card per story
Stories tagged #vmware
CISA adds exploited VMware ESXi logging flaw CVE-2026-41709 to KEV
Federal remediation is due November 11, 2026; the CVSS 2.7 flaw only hides actions by someone who already has admin rights.
CISA lists VMware ESX logging flaw exploited by Warp Panda
CVE-2026-41709 lets an admin skip some logs; federal agencies must patch by November 11, 2026.
Canada updates VMware advisory after two CVEs enter CISA KEV
CVE-2026-41709 joined the KEV catalog on October 28; CVE-2026-59310 was added on August 18.
CISA adds VMware ESX and Linux kernel flaws to KEV
CVE-2026-41709 and CVE-2026-46300 are actively exploited; BOD 26-04 requires FCEB agencies to prioritize them.
CISA KEV: VMware ESX logging flaw CVE-2026-41709 exploited
An attacker who already has admin access can perform certain ESX operations without them being logged; due November 11.
VLC and VMware binaries side-load malware targeting Brazil and Portugal
WatchGuard linked the activity to Overlord RAT, Lampion, and a Pascal remote-access payload, without one shared operator.
1
Ransomware groups exploit GlobalProtect MFA bypass CVE-2026-0257
Unit 42 says attackers forged authentication-override cookies, then pulled domain credentials from a VMware virtual disk offline.
1
Topgolf saved over $11.3M after leaving VMware
Topgolf reports more than $11.3 million saved after migrating from VMware to VergeOS.
VMware is pushing so many patches, it thinks users need new tools to manage the flood
Broadcom will sell HyperArmor to virtually patch VCF, lock configurations, and add MFA.
PoC Exploit Released for Critical VMware Vulnerability Enabling Guest-to-Host Attacks
Public PoC for CVE-2026-59346 crashes VMware Workstation and Fusion through a guest-to-host integer overflow.
ESXi Exploitation in the Wild
Huntress stopped an intrusion that used a VMware ESXi VM-escape toolkit after SonicWall VPN access.
CISA: Critical VMware RCE flaw now exploited by ransomware gangs
CISA warns ransomware gangs now exploit critical VMware vCenter syslog RCE CVE-2026-59310, already KEV-listed after APT compromises across 47 countries.
ZDI-26-647: VMware Workstation VMXNET3 TSO Segmentation Integer Overflow Local Privilege Escalation Vulnerability
ZDI disclosed an integer overflow in VMware Workstation's VMXNET3 TSO code (CVE-2026-59346) enabling local privilege escalation.
Panzer Ransomware Targets Italian Manufacturers and Telecom Firms With ESXi-Ready RaaS
New Panzer ransomware-as-a-service operation lists Italian firms Doimo Cucine and NTE Italia as victims, offering encryptors for Windows, Linux, FreeBSD, and ESXi.
1
Critical VMware Workstation and Fusion Flaw Lets VM Admins Execute Host Code
Broadcom patched two VMware Workstation and Fusion flaws, including critical integer overflow CVE-2026-59346 (CVSS 9.3), letting guest admins execute host code; no exploitation seen.
Broadcom Patches Critical VMware Workstation and Fusion VM
Broadcom patched critical VMware Workstation and Fusion VM-escape flaws CVE-2026-59346 (CVSS 9.3) and CVE-2026-59347 (CVSS 8.1); update to 26H1u1.
China-Linked Fire Ant Hijacks Cisco Routers to Steal Credentials and Blind Security Logs
China-nexus espionage group Fire Ant compromised Cisco IOS XR routers and TACACS servers to harvest credentials, capture traffic and suppress logs.
U.S. CISA adds Apple macOS, Microsoft SharePoint, Broadcom VMware vCenter, and Microsoft IKE flaws to its Known Exploited Vulnerabilities catalog
CISA adds actively exploited flaws in Microsoft IKE, SharePoint, VMware vCenter, and macOS Screen Sharing to KEV catalog, due August 21.
Suspected China-Nexus Actor Exploits VMware vCenter Flaw, Deploys Babuk
QUIRSO attributes exploitation of VMware vCenter CVE-2026-59310 to a suspected China-nexus actor that hit 361 IPs in 47 countries, deploying backdoors and Babuk.
vCenter Flaw Exploited Just Five Days After Disclosure
Attackers began exploiting critical vCenter flaw CVE-2026-59310 five days after Broadcom's disclosure, putting enterprise VMware deployments at risk.
1
Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access
Attackers actively exploit critical VMware vCenter flaw CVE-2026-59310, installing reverse_ssh backdoors on 361 hosts across 47 countries.
Three Critical VMware Flaws Allow Auth Bypass, Code Execution, and VM Escape
Broadcom patches three critical VMware flaws, including vCenter auth bypass CVE-2026-59309 and an ESX VM escape, urging immediate updates.
3