Attack on VMware vCenter: CVE-2026-59310 exploited for stealthy remote access

The German firm QUIRSO has reported active exploitation of a recent critical vulnerability in Broadcom VMware vCenter. At issue is CVE-2026-59310 (CVSS score — 9.8), a directory traversal flaw that lets an attacker with network access to the vCenter server execute arbitrary code. Broadcom released patches late last month.

How the attack unfolds

The activity was uncovered during incident response. The attack chain began with the directory traversal characteristic of this vulnerability, after which a malicious cron job was installed on the compromised host. For persistence, the attackers used reverse_ssh — an open-source tool that opens an SSH connection back to infrastructure under their control.

The value of reverse_ssh lies in the fact that the connection is initiated from the inside out — meaning it slips past defenses designed to block suspicious inbound requests. That said, the mere presence of reverse_ssh, QUIRSO stresses, is not proof of a breach: it becomes a red flag only when combined with an unauthorized installation, unexpected outbound connections, or execution on a vulnerable vCenter.

Scale and timeline

The first contacts between infected systems and the attackers' domains were recorded on August 3 — five days after the vulnerability was publicly disclosed. In all, QUIRSO counted up to 361 unique victim IP addresses across 47 countries; the largest number of victims were in Germany, the United States, Turkey, Iran and France. In the researchers' view, the close correlation between the disclosure date and the onset of the attacks indicates that the publication itself was the starting point of the campaign — though it cannot be ruled out that the attackers knew about the flaw beforehand.

Who is behind the attacks has not been established with certainty, but the assumption is that it is an APT group. The report's authors note that VMware's appliances have long drawn the interest of Chinese actors — for example, UNC5174, which exploited vulnerabilities in VMware Tools and vCenter in espionage campaigns. The reverse_ssh tool has surfaced before, too: in April 2025, SentinelOne described the PurpleHaze cluster with its GoReShell backdoor, which borrows the tool's functionality.

Another vulnerability in the crosshairs

Meanwhile, Defused Cyber is observing a surge in vCenter scanning tied to another vulnerability — CVE-2026-59309 (CVSS 9.8), an authentication bypass flaw in vmdir. Honeypots are logging version probing via POST /sdk/ and circumvention of the SAML SSO flow through /websso. Even so, as QUIRSO co-founder Denis Shadkovsky noted, there is not yet enough data to link this scanning to the intrusion that was investigated. Only one thing can be stated with confidence: the case studied involves a successful compromise, and the initial vector was almost certainly CVE-2026-59310.

Source: The Hacker News