Threat actors have begun exploiting a critical vulnerability in VMware vCenter just days after Broadcom shipped a patch, according to incident response firm Quirso.

The flaw, tracked as CVE-2026-59310 (CVSS 9.8), is a directory traversal issue in vCenter’s Syslog server that leads to remote code execution. Broadcom disclosed and patched the bug on July 29 alongside four other security defects across multiple VMware products. Its advisory states that a malicious actor with network access to vCenter can exploit the issue to execute arbitrary code.

Rapid Exploitation Following Disclosure

Quirso reports that an advanced persistent threat (APT) group has been actively targeting web-accessible vCenter servers vulnerable to CVE-2026-59310, deploying a reverse shell to maintain persistent access. The firm identified more than 360 victim IP addresses spread across 47 countries, with roughly half concentrated in just five: Germany, the United States, Turkey, Iran, and France.

Quirso cautions that the IP address count does not map directly to a number of victim organizations, since some addresses belong to hosting providers, cloud networks, or other shared infrastructure.

Exploitation activity reportedly started on August 3, with more than 340 victim IP addresses observed connecting to attacker-controlled infrastructure within just two days, by August 5. Quirso notes that while the attacker may have had prior knowledge of the vulnerability, the tight correlation between the disclosure date and the start of exploitation suggests the public advisory itself served as the starting point for the campaign.

Reverse SSH Framework Used for Persistence

After gaining initial access, the attackers deployed reverse_ssh, an open source SSH reverse shell framework, to establish an outbound control connection from compromised vCenter systems. This approach helps the attackers bypass security controls that typically restrict inbound connections, since the compromised host initiates the outbound link itself.

Quirso has released a generic YARA rule to help defenders detect reverse_ssh builds. Because the tool has legitimate uses in penetration testing, the firm advises organizations with internet-exposed vCenter systems to validate any detections by also checking for unauthorized installations, unexpected outbound connections, and unusual process execution.

Recommendations

  • Apply Broadcom’s patch for CVE-2026-59310 immediately on all affected vCenter deployments.
  • Restrict network access to vCenter Syslog services and avoid unnecessary public exposure.
  • Scan environments using the published YARA rule and hunt for unexpected outbound SSH connections.
  • Review logs for signs of compromise dating back to August 3, when exploitation activity reportedly began.