Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access
Critical security flaw allows malicious actors to execute arbitrary code remotely.
1Critical VMware Vulnerability Actively Exploited
According to new findings from QUIRSO, threat actors have begun actively exploiting a recently patched critical security flaw in Broadcom VMware vCenter. Identified as CVE-2026-59310, this vulnerability has a CVSS score of 9.8 and allows a malicious actor with network access to execute arbitrary code. Broadcom released patches for this flaw late last month.
2Details of the Attack Chain
German cybersecurity company QUIRSO discovered this activity during an incident response engagement. The attack chain exhibited path traversal activity consistent with the flaw, followed by the deployment of a malicious cron job to establish persistence on the host using reverse_ssh, an open-source tool for setting up SSH connections to attacker-controlled infrastructure.
3Affected Systems and Geographic Distribution
Compromised systems identified by QUIRSO were found to have first established contact with the attacker's domains on August 3, five days after Broadcom publicly disclosed the vulnerabilities. In total, 361 unique victim IP addresses across 47 countries were identified, with the most affected countries being Germany, the U.S., Turkey, Iran, and France.
4Timing and Likely Attacker Profile
QUIRSO noted that while the attacker might have had prior knowledge of the vulnerability, the strong correlation between disclosure and exploitation times suggests the disclosure as the campaign's starting point. It's unclear who's behind the exploitation campaign, but it's believed to be the work of a suspected advanced persistent threat (APT) actor.
5VMware's History of Security Issues
VMware appliances have been lucrative targets for Chinese threat actors like UNC5174, who have weaponized security flaws affecting VMware Tools and VMware vCenter in various espionage campaigns. In April 2025, SentinelOne disclosed details about PurpleHaze, a threat cluster that targeted a South Asian government entity with GoReShell, a Windows backdoor.
6Significance of reverse_ssh
The use of reverse_ssh is notable as it allows attackers to establish outbound connections to endpoints under their control, effectively bypassing security measures designed to block suspicious inbound requests. QUIRSO emphasized that while reverse_ssh presence alone shouldn't be treated as malicious proof, its combination with unauthorized installation or unexpected connections becomes a high-priority indicator.
7Increased Scanning Activities
These disclosures coincide with Defused Cyber reporting a spike in VMware vCenter scanning activities targeting potential exploitation of CVE-2026-59309. The company's honeypots detected increased fingerprinting activities, including version probes via POST /sdk/ and walks of the /websso SAML SSO flow, aligning with Broadcom's VMSA-2026-0006 patch release.
8Expert Insight and Conclusion
Denis Szadkowski, COO of QUIRSO GmbH, stated there's insufficient evidence currently to link CVE-2026-59309 exploitation attempts with the intrusion set associated with CVE-2026-59310. He added, 'What we can say with much higher confidence is that the activity we investigated represents successful compromise rather than mere attempts, with forensic evidence strongly pointing to CVE-2026-59310 as the initial access vector.'