# Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access Critical security flaw allows malicious actors to execute arbitrary code remotely. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-08-12 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/c40e9618-dd85-4e06-9fa4-8c54cbf05522 ## Critical VMware Vulnerability Actively Exploited According to new findings from QUIRSO, threat actors have begun actively exploiting a recently patched critical security flaw in Broadcom VMware vCenter. Identified as CVE-2026-59310, this vulnerability has a CVSS score of 9.8 and allows a malicious actor with network access to execute arbitrary code. Broadcom released patches for this flaw late last month. ## Details of the Attack Chain German cybersecurity company QUIRSO discovered this activity during an incident response engagement. The attack chain exhibited path traversal activity consistent with the flaw, followed by the deployment of a malicious cron job to establish persistence on the host using reverse_ssh, an open-source tool for setting up SSH connections to attacker-controlled infrastructure. ## Affected Systems and Geographic Distribution Compromised systems identified by QUIRSO were found to have first established contact with the attacker's domains on August 3, five days after Broadcom publicly disclosed the vulnerabilities. In total, 361 unique victim IP addresses across 47 countries were identified, with the most affected countries being Germany, the U.S., Turkey, Iran, and France. ## Timing and Likely Attacker Profile QUIRSO noted that while the attacker might have had prior knowledge of the vulnerability, the strong correlation between disclosure and exploitation times suggests the disclosure as the campaign's starting point. It's unclear who's behind the exploitation campaign, but it's believed to be the work of a suspected advanced persistent threat (APT) actor. ## VMware's History of Security Issues VMware appliances have been lucrative targets for Chinese threat actors like UNC5174, who have weaponized security flaws affecting VMware Tools and VMware vCenter in various espionage campaigns. In April 2025, SentinelOne disclosed details about PurpleHaze, a threat cluster that targeted a South Asian government entity with GoReShell, a Windows backdoor. ## Significance of reverse_ssh The use of reverse_ssh is notable as it allows attackers to establish outbound connections to endpoints under their control, effectively bypassing security measures designed to block suspicious inbound requests. QUIRSO emphasized that while reverse_ssh presence alone shouldn't be treated as malicious proof, its combination with unauthorized installation or unexpected connections becomes a high-priority indicator. ## Increased Scanning Activities These disclosures coincide with Defused Cyber reporting a spike in VMware vCenter scanning activities targeting potential exploitation of CVE-2026-59309. The company's honeypots detected increased fingerprinting activities, including version probes via POST /sdk/ and walks of the /websso SAML SSO flow, aligning with Broadcom's VMSA-2026-0006 patch release. ## Expert Insight and Conclusion Denis Szadkowski, COO of QUIRSO GmbH, stated there's insufficient evidence currently to link CVE-2026-59309 exploitation attempts with the intrusion set associated with CVE-2026-59310. He added, 'What we can say with much higher confidence is that the activity we investigated represents successful compromise rather than mere attempts, with forensic evidence strongly pointing to CVE-2026-59310 as the initial access vector.' ## Sources covering this story - https://thehackernews.com/2026/08/attackers-exploit-vmware-vcenter.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._