CISA Says Ransomware Gangs Are Exploiting Critical VMware vCenter Flaw
Summary
CISA says ransomware gangs are exploiting VMware vCenter flaw CVE-2026-59310. Broadcom patched the directory traversal flaw in July; QUIRSO reported 361 compromised IP addresses, and more than 450 vCenter servers remain exposed online.
Key points
- CVE-2026-59310 is a critical directory traversal flaw in the VMware vCenter Syslog server; Broadcom said unauthenticated attackers could use it to execute arbitrary code.
- Broadcom released a patch on July 29 and urged customers to treat remediation as an emergency.
- QUIRSO reported finding more than 361 IP addresses across 47 countries compromised after exploitation to deploy a reverse SSH tool for persistence and remote access.
- CISA added the flaw to its Known Exploited Vulnerabilities catalog and ordered government agencies to secure vCenter systems within three days.
- CISA later flagged the vulnerability as actively exploited by ransomware gangs.
- Shadowserver tracks more than 450 VMware vCenter servers exposed online; the article says it is unknown how many have been patched.
Article Details
- Vulnerability Types
- Directory traversal
- Severity
- Critical
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
CVE
CVE-2024-37079Since the start of the year, the cybersecurity agency has also flagged VMware Aria Operations (CVE-2026-22719) and VMware vCenter Server (CVE-2024-37079) flaws as exploited in attacks in February and March.CVE-2025-22225in February that ransomware groups began exploiting a VMware ESXi sandbox escape vulnerability (CVE-2025-22225), which Chinese-speaking threat actors have targeted in zero-day attacks since at least February 2024.CVE-2026-22719Since the start of the year, the cybersecurity agency has also flagged VMware Aria Operations (CVE-2026-22719) and VMware vCenter Server (CVE-2024-37079) flaws as exploited in attacks in February and March.CVE-2026-59310CISA warned that ransomware gangs are now abusing the critical VMware vCenter vulnerability CVE-2026-59310, which Broadcom patched in July as an urgent directory traversal flaw.
Vendors
Products
VMware Aria OperationsSince the start of the year, the cybersecurity agency has also flagged VMware Aria Operations (CVE-2026-22719) and VMware vCenter Server (CVE-2024-37079) flaws as exploited in attacks in February and March.VMware ESXiCISA also warned in February that ransomware groups began exploiting a VMware ESXi sandbox escape vulnerability (CVE-2025-22225), which Chinese-speaking threat actors have targeted in zero-day attacks since at leastVMware vCenterCISA warned that ransomware gangs are now abusing the critical VMware vCenter vulnerability CVE-2026-59310, which Broadcom patched in July as an urgent directory traversal flaw.