Ransomware Gangs Join Attacks on Critical VMware vCenter RCE Flaw

The US Cybersecurity and Infrastructure Security Agency (CISA) has reported that ransomware groups have joined the ongoing attacks on a critical VMware vCenter vulnerability. Broadcom patched the flaw, tracked as CVE-2026-59310, back on July 29, describing it as a critical directory traversal vulnerability in the vCenter Syslog server: an unauthenticated attacker can exploit it to execute arbitrary code.

At the time, Broadcom used a supplementary FAQ to urge customers to treat installing the fix as an emergency and not to put off patching.

From APT Reconnaissance to Mass Attacks

Two weeks after the patch was released, the digital forensics and incident response firm QUIRSO reported that it had discovered more than 361 compromised IP addresses across 47 countries. According to its findings, a suspected APT group had exploited the vulnerability to deploy a reverse SSH tool for persistence and remote access.

CISA soon added CVE-2026-59310 to its Known Exploited Vulnerabilities (KEV) catalog and ordered federal agencies to secure their vCenter systems within three days. Over the past weekend, the agency updated the catalog again, noting that the vulnerability is now actively being exploited by ransomware operators.

The monitoring service Shadowserver is currently tracking more than 450 internet-exposed VMware vCenter servers, though there is no data on how many of them have already been patched.

Why VMware Is the Target

CISA has not yet disclosed details about the specific ransomware attacks. The reason for the interest in VMware is obvious: a compromised vCenter or ESXi opens access to an organization's network and to the data on its internal systems. In recent years, several groups have developed dedicated encryptors aimed at VMware virtual machines — precisely where enterprises store and process their corporate data.

This is not an isolated story. In February, CISA warned about the exploitation of a sandbox escape vulnerability in VMware ESXi (CVE-2025-22225) that Chinese-speaking threat actors had been using as a zero-day since at least February 2024. Since the start of the year, the agency has also flagged as exploited flaws in VMware Aria Operations and VMware vCenter Server.

Over the past five years, CISA has marked 26 VMware vulnerabilities as exploited in real-world attacks, nine of which were also used in ransomware campaigns. VMware products remain one of the most attractive targets for anyone looking for a shortcut to an entire corporate infrastructure.

Source: Bleeping Computer