CVE-2026-59310: vCenter RCE Exploited for Reverse SSH Access

Critical VMware vCenter Syslog Server RCE Exploitation

Runtime Rebel is issuing an urgent advisory regarding the active exploitation of CVE-2026-59310, a critical directory traversal vulnerability affecting VMware vCenter Syslog Server. This flaw allows an unauthenticated attacker with network access to execute arbitrary code remotely, posing a severe risk to organizations utilizing VMware vCenter for their virtual infrastructure management. The ongoing campaign leverages this vulnerability to deploy a reverse SSH tool, establishing persistence and remote control over compromised systems.

Technical Analysis of CVE-2026-59310 Exploitation

Broadcom initially disclosed CVE-2026-59310 as a critical security issue on July 29, releasing an emergency update to address it. However, within five days of this disclosure, on August 3, digital forensics and incident response (DFIR) company QUIRSO began observing active exploitation of the vulnerability. The campaign expanded rapidly, with 151 new victim IP addresses identified on August 4, escalating to 343 by the following day. By August 7, QUIRSO had identified a total of 361 unique victim IP addresses across 47 countries, with more than half concentrated in Germany, the U.S., Turkey, Iran, and France, according to BleepingComputer.

The exploitation chain involves attackers gaining access to vulnerable vCenter systems and subsequently deploying the open-source reverse_ssh framework. This framework is instrumental in establishing persistence and securing remote access. A reverse SSH connection is particularly effective for creating an outbound command-and-control (C2) channel, which can often bypass common firewall rules and other network security measures designed to restrict inbound connections. This technique ensures attackers maintain access even after initial compromise, making detection and eradication more challenging.

VMware vCenter is a central management platform for extensive virtual infrastructures, overseeing virtual machines, ESXi servers, configurations, and access permissions. Its broad control over multiple critical systems makes it a high-value target for threat actors aiming for data theft or operational disruption.

QUIRSO researchers suggest an advanced persistent threat (APT) actor might be behind this exploitation activity. However, they have not provided concrete evidence to support this attribution, citing ongoing coordination with law enforcement. This uncertainty underscores the need for organizations to focus on the technical indicators of compromise rather than specific actor attribution at this stage.

Mitigation for CVE-2026-59310 vCenter

Given the active exploitation and the critical nature of this vulnerability, immediate action is paramount. Defenders must prioritize the following:

• Emergency Patching: The most critical step is to apply the emergency update provided by Broadcom for CVE-2026-59310 to all affected VMware vCenter Syslog Server instances. Broadcom has explicitly stated that no workarounds or alternative mitigations exist, making the patch the sole effective defense.
• Detection of Reverse SSH: Organizations should actively monitor their network traffic for suspicious outbound SSH connections, especially from vCenter servers. QUIRSO has released a generic YARA rule that can detect reverse_ssh client binaries. While this rule may trigger for legitimate uses of the tool, its deployment can help identify potential compromises. Security teams should implement and continuously monitor for indicators related to reverse_ssh to effectively detect CVE-2026-59310 reverse SSH activity.
• Network Segmentation: Isolate vCenter servers as much as possible, placing them in dedicated management networks with strict access controls. Limit network access to these servers only to necessary administrative workstations and services.
• Regular Auditing and Logging: Ensure comprehensive logging is enabled for vCenter and its components, including Syslog Server. Regularly review logs for unusual activity, failed login attempts, or unexpected process executions.

The widespread impact across hundreds of IP addresses globally underscores the urgency of addressing this critical vulnerability. Organizations are advised to consult Broadcom’s official advisories and any further reports from QUIRSO for additional threat intelligence and remediation guidance.

Related: VMware Avi Load Balancer: Severe Vulnerabilities Enable RCE, Bypass, VMware Workspace ONE Access RCE via CVE-2022-22960 — Patch Now