QUIRSO Reports Active Exploitation of VMware vCenter CVE-2026-59310
Summary
QUIRSO reports that attackers are exploiting VMware vCenter CVE-2026-59310 to deploy reverse_ssh, identifying 361 affected IPs across 47 countries. Broadcom has released fixes for affected vCenter versions.
Key points
- CVE-2026-59310 is a critical directory traversal flaw in vCenter Syslog Server that Broadcom says could allow unauthenticated remote code execution.
- QUIRSO observed compromised systems connecting to attacker infrastructure starting August 3 and identified 361 victim IP addresses across 47 countries by August 7.
- The reported attackers deployed reverse_ssh for persistence and remote access through an outbound command-and-control channel.
- Broadcom released fixes for vCenter 9.1, 9.0, and 8.0 branches; it provided no workarounds and urged administrators to apply the updates.
- QUIRSO’s generic YARA rule detects reverse_ssh client binaries, but legitimate use of the tool can also trigger it.
- QUIRSO suspects an APT actor but provided no supporting evidence and withheld specific indicators while coordinating with law enforcement.
Article Details
- Vulnerability Types
- Directory traversal
- Severity
- Critical
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
CVE
Vendors
Products
VMware vCenterA newly patched critical flaw, CVE-2026-59310, in VMware vCenter Syslog Server is being actively exploited to install the reverse_ssh tool for persistence and remote access.VMware vCenter Syslog ServerA newly patched critical flaw, CVE-2026-59310, in VMware vCenter Syslog Server is being actively exploited to install the reverse_ssh tool for persistence and remote access.
Tools
Countries
FranceCompromises have been identified at 361 IP addresses across 47 countries, more than half located in Germany, the U.S., Turkey, Iran, and France.GermanyCompromises have been identified at 361 IP addresses across 47 countries, more than half located in Germany, the U.S., Turkey, Iran, and France.IranCompromises have been identified at 361 IP addresses across 47 countries, more than half located in Germany, the U.S., Turkey, Iran, and France.TurkeyCompromises have been identified at 361 IP addresses across 47 countries, more than half located in Germany, the U.S., Turkey, Iran, and France.United StatesCompromises have been identified at 361 IP addresses across 47 countries, more than half located in Germany, the U.S., Turkey, Iran, and France.