CVE-2026-59310: VMware vCenter Syslog Path Traversal RCE Under Global APT Attack; 361 IPs in 47 Countries Compromised

VMware vCenter Server Syslog path-traversal RCE CVE-2026-59310 (CVSS 9.8) exploited by global APT 5 days after disclosure. 361 IPs across 47 countries compromised. Attackers deployed reverse_ssh persistence.

CVE-2026-59310 is a vCenter Server Syslog directory traversal flaw disclosed and patched by Broadcom/VMware on 29 July 2026. CVSS 9.8. Unauthenticated network attackers execute arbitrary code by manipulating path strings. Mass exploitation started 5 days after patch release. German IR firm QUIRSO observed attackers implanting cron + reverse_ssh for persistent reverse channels. Victim IPs span 47 countries. Patching does not remove already-implanted backdoors.

Incident Overview

Broadcom published a vCenter update advisory on 29 July, marking CVE-2026-59310 as a Syslog directory traversal defect, CVSS 9.8. Dark Reading reported global mass-exploitation attempts from around 3 August. BleepingComputer tracked attackers deploying cron jobs to execute reverse_ssh immediately after initial access, opening persistent outbound tunnels to external C2. QUIRSO confirmed the full kill chain in a customer IR. 361 unique victim IPs across 47 countries appeared on the attackers' reverse-connection list. Hotspots: United States, Germany, France, Turkey, Iran. CyberRecaps 14 August daily threat recap listed CVE-2026-59310 with macOS screen-sharing CVE-2026-65400 as the day's dual in-the-wild high-severity vulns.

Technical Details

Flaw lives in the vCenter Syslog service. Attackers craft path strings containing `../` sequences to bypass directory bounds, then read/write OS files and run arbitrary commands. Network vector. No authentication. vCenter management port reachability is enough.

QUIRSO-observed follow-on:

• Exploit CVE-2026-59310 for vCenter host root;
• Deploy cron to launch the reverse_ssh binary; open an outbound encrypted channel;
• Write redundant triggers into vCenter persistence (cron, systemd, scheduled scripts);
• Lateral movement across ESXi hosts and VMs under vCenter.

reverse_ssh and SSH reverse tunnels use outbound connections. Inbound-only, no-outbound-allowed environments still get punched through. vCenter is the virtualization management plane. Compromise controls all ESXi hosts and VMs. High-value target for ransomware crews and nation-state APT.

Impact Assessment

vCenter is the core control plane of enterprise virtualization. Compromise enables ransomware push, mass VM power-off, data theft, virtual-network rewrite. CVE-2026-59310 combines CVSS 9.8 + unauthenticated + network-reachable. Classic n-day: patch-to-exploit gap under 5 days. Multiple Q1 2026 threat reports ranked VMware vCenter among 2026's top 5 attacker surfaces. 361 IPs in 47 countries confirms industrialized exploitation by an APT with resource-scheduling capacity.

Remediation

• Apply the Broadcom/VMware CVE-2026-59310 patch immediately. Verify all vCenter instances are upgraded.
• Forensic check on vCenter and ESXi: `crontab -l`, `ls /etc/cron.d/`, `systemctl list-timers`. Hunt `reverse_ssh` and suspicious outbound connections.
• Scan the vCenter filesystem with QUIRSO's public YARA rules.
• Segment the vCenter management interface. Do not expose it to the public internet.
• Default-deny vCenter outbound firewall. Allow only required update sources and NTP domains. SIEM-alert unauthorized SSH outbound to unknown IPs.

Sources

• Dark Reading: Global Threat Campaign Hits Critical VMware vCenter Flaw
• BleepingComputer: Critical VMware vCenter RCE Flaw Exploited for Reverse SSH Access
• HawkEye: Weekly Threat Landscape Digest — Week 33
• CyberRecaps: Daily Cybersecurity News — August 14, 2026