A critical directory traversal vulnerability (CVE-2026-59310) in VMware vCenter's Syslog Server, patched by Broadcom on July 29, is being actively exploited to gain unauthenticated remote code execution. DFIR firm QUIRSO reports 361 compromised IP addresses across 47 countries as of August 7, with attackers deploying the open-source reverse_ssh tool for persistent, firewall-evading command-and-control access. Broadcom offers no workarounds; admins must update to vCenter 9.1.0.0300, 9.0.2.0100, or 8.0 U3k/U2f.
Table of contents
Related Articles:Questions this post answers
What is CVE-2026-59310 and which VMware vCenter versions are affected?
CVE-2026-59310 is a critical, unauthenticated directory traversal vulnerability in the vCenter Syslog Server that allows arbitrary code execution. Broadcom disclosed it on July 29 with no workarounds available. Fixed versions are vCenter 9.1.0.0300, 9.0.2.0100, and 8.0 U3k or U2f depending on the branch; administrators must apply the emergency patch immediately. daily.dev helps infrastructure teams track critical patches like this vCenter fix as they roll out.
How widespread is the exploitation of the VMware vCenter vCenter Syslog Server vulnerability CVE-2026-59310?
Compromises were identified at 361 IP addresses across 47 countries by August 7, with more than half located in Germany, the U.S., Turkey, Iran, and France. Exploitation began August 3, just five days after the patch release, with victim counts jumping from 151 new IPs on August 4 to 343 total by August 5, according to DFIR firm QUIRSO. security teams tracking active exploitation campaigns like this one can follow updates on daily.dev.
What tool are attackers using after exploiting the VMware vCenter CVE-2026-59310 flaw?
Attackers deploy the open-source reverse_ssh framework to establish persistence and remote access after compromising vulnerable vCenter systems via CVE-2026-59310. The reverse SSH connection creates an outbound command-and-control channel that can bypass firewalls, and QUIRSO has released a YARA rule to detect reverse_ssh client binaries, though it also flags legitimate use. daily.dev keeps defenders informed on post-exploitation tooling like reverse_ssh as campaigns evolve.