--- title: Global Threat Campaign Hits Critical VMware vCenter Flaw description: A critical VMware vCenter directory traversal flaw, CVE-2026-59310 (CVSS 9.8), came under active exploitation by a suspected APT actor starting August 3, just... canonical: https://daily.dev/posts/global-threat-campaign-hits-critical-vmware-vcenter-flaw-wnpopmivh twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Global Threat Campaign Hits Critical VMware vCenter Flaw | daily.dev og:description: A critical VMware vCenter directory traversal flaw, CVE-2026-59310 (CVSS 9.8), came under active exploitation by a suspected APT actor starting August 3, just... og:url: https://daily.dev/posts/global-threat-campaign-hits-critical-vmware-vcenter-flaw-wnpopmivh og:image: https://api.daily.dev/og/posts/WnpOPMIvh.png og:image:alt: Global Threat Campaign Hits Critical VMware vCenter Flaw og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Global Threat Campaign Hits Critical VMware vCenter Flaw **[Dark Reading](https://daily.dev/sources/dr)** · 5 min read · 0 upvotes · 0 comments ## Summary A critical VMware vCenter directory traversal flaw, CVE-2026-59310 (CVSS 9.8), came under active exploitation by a suspected APT actor starting August 3, just five days after Broadcom's July 29 disclosure. German IR firm QUIRSO tracked 361 unique IP addresses across 47 countries, with the US, France, Iran, and Turkey most targeted. The attacker uses reverse_ssh to establish persistent access that survives patching, meaning organizations must conduct forensic investigations rather than rely on patching alone. QUIRSO released a YARA rule to detect reverse_ssh builds, and experts recommend treating vCenter as an untrusted zone with strict network segmentation. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-59310 and how severe is it? CVE-2026-59310 is a critical directory traversal vulnerability in VMware vCenter with a CVSS score of 9.8, disclosed by Broadcom on July 29. It allows an attacker with network access to a vCenter instance to remotely execute arbitrary code within the target's virtual environment, giving them broad access across the affected infrastructure. _Teams tracking vCenter exposure follow vulnerability disclosures like this one on daily.dev._ ### Does patching CVE-2026-59310 remove an attacker who already exploited it? No, patching alone does not remove an attacker's access if they already exploited CVE-2026-59310 and installed reverse_ssh, an open-source tool that creates outbound control channels from compromised systems. Because the malware persists independently of the vulnerability, security teams need to run a forensic investigation of potentially affected vCenter systems to rule out existing compromise, even after updating to a fixed version. _Responders weighing patch-versus-persistence tradeoffs track incident writeups like this on daily.dev._ ### How widespread was the exploitation campaign against VMware vCenter's CVE-2026-59310 flaw? Exploitation began August 3, less than a week after public disclosure on July 29, and was traced to a single suspected advanced persistent threat actor operating across 47 countries. Incident response firm QUIRSO identified 361 unique IP addresses affected, with the US, France, Iran, and Turkey most heavily targeted, though some addresses represent shared cloud or hosting infrastructure rather than distinct victims. _Security teams scoping the blast radius of a campaign like this follow updates on daily.dev._ ## Similar posts on daily.dev - [CISA: Critical VMware RCE flaw now exploited by ransomware gangs](https://daily.dev/posts/cisa-critical-vmware-rce-flaw-now-exploited-by-ransomware-gangs-ofrnqjulv) · BleepingComputer · 1 upvotes · 0 comments - [China Exploited New VMware Bug for Nearly a Year](https://daily.dev/posts/china-exploited-new-vmware-bug-for-nearly-a-year-2wyofgcv8) · Dark Reading · 0 upvotes · 0 comments - [VMware fixes command injection flaw in Aria Operations](https://daily.dev/posts/vmware-fixes-command-injection-flaw-in-aria-operations-ue2mrjloo) · CSO Online · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#vmware](https://daily.dev/tags/vmware) [View this post on daily.dev](https://daily.dev/posts/global-threat-campaign-hits-critical-vmware-vcenter-flaw-wnpopmivh) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Global Threat Campaign Hits Critical VMware vCenter Flaw","url":"https://daily.dev/posts/global-threat-campaign-hits-critical-vmware-vcenter-flaw-wnpopmivh","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/global-threat-campaign-hits-critical-vmware-vcenter-flaw-wnpopmivh"},"datePublished":"2026-08-13T21:10:45.025Z","dateModified":"2026-08-13T21:17:34.089Z","description":"A critical VMware vCenter directory traversal flaw, CVE-2026-59310 (CVSS 9.8), came under active exploitation by a suspected APT actor starting August 3, just...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c68cdabef9cb9ad17b54362aea4533b9?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c68cdabef9cb9ad17b54362aea4533b9?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Dark Reading","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Dark Reading","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/dr","url":"https://daily.dev/sources/dr"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/global-threat-campaign-hits-critical-vmware-vcenter-flaw-wnpopmivh","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,vmware","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Dark Reading","item":"https://daily.dev/sources/dr"},{"@type":"ListItem","position":3,"name":"Global Threat Campaign Hits Critical VMware vCenter Flaw"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/global-threat-campaign-hits-critical-vmware-vcenter-flaw-wnpopmivh#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-59310 and how severe is it?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-59310 is a critical directory traversal vulnerability in VMware vCenter with a CVSS score of 9.8, disclosed by Broadcom on July 29. It allows an attacker with network access to a vCenter instance to remotely execute arbitrary code within the target's virtual environment, giving them broad access across the affected infrastructure. Teams tracking vCenter exposure follow vulnerability disclosures like this one on daily.dev."}},{"@type":"Question","name":"Does patching CVE-2026-59310 remove an attacker who already exploited it?","acceptedAnswer":{"@type":"Answer","text":"No, patching alone does not remove an attacker's access if they already exploited CVE-2026-59310 and installed reverse_ssh, an open-source tool that creates outbound control channels from compromised systems. Because the malware persists independently of the vulnerability, security teams need to run a forensic investigation of potentially affected vCenter systems to rule out existing compromise, even after updating to a fixed version. Responders weighing patch-versus-persistence tradeoffs track incident writeups like this on daily.dev."}},{"@type":"Question","name":"How widespread was the exploitation campaign against VMware vCenter's CVE-2026-59310 flaw?","acceptedAnswer":{"@type":"Answer","text":"Exploitation began August 3, less than a week after public disclosure on July 29, and was traced to a single suspected advanced persistent threat actor operating across 47 countries. Incident response firm QUIRSO identified 361 unique IP addresses affected, with the US, France, Iran, and Turkey most heavily targeted, though some addresses represent shared cloud or hosting infrastructure rather than distinct victims. Security teams scoping the blast radius of a campaign like this follow updates on daily.dev."}}]} ```