CISA confirmed on September 15, 2026 that ransomware operators have joined an already active exploitation campaign against CVE-2026-59310, a critical directory traversal vulnerability in VMware vCenter Server’s Syslog service. The flaw carries a CVSS score of 9.8 and lets an unauthenticated attacker run arbitrary code on an exposed vCenter instance. Broadcom patched it in late July, but attackers started exploiting it within days of disclosure, and researchers have now tracked hundreds of compromised servers across dozens of countries.
Broadcom disclosed CVE-2026-59310 alongside a related authentication bypass bug, CVE-2026-59309, in advisory VMSA-2026-0006 on July 29. Both carry the same 9.8 CVSS score. Within about five days, threat actors were already dropping open source reverse shells on compromised servers to hold onto access. CISA added the flaw to its Known Exploited Vulnerabilities catalog on August 18 and gave federal agencies three days to patch or take exposed systems offline, flagging it for forensic triage under BOD 26-04 rather than a simple patch-and-move-on.
What Changed with CVE-2026-59310 This Week
The vulnerability itself isn’t new. What changed over the past few days is who’s using the access. Multiple ransomware groups are now working off the same foothold that espionage-focused attackers established over the summer, according to CISA’s updated guidance. Threat intel firm QUIRSO has linked the campaign to more than 360 compromised IP addresses across 47 countries, and Shadowserver still counts over 450 vCenter servers reachable from the open internet as of this week.
vCenter sits at the center of most VMware deployments. It’s the control plane for provisioning, snapshots, and access across every VM on a cluster, so a successful exploit doesn’t just hand an attacker one server, it hands them a path to everything vCenter manages. That’s a very different blast radius than a single compromised application server, and it’s exactly why an unpatched, internet-facing vCenter instance from July is now a live ransomware entry point in September.
What to Do About It Now
- Patch to the fixed version listed in Broadcom’s response matrix for VMSA-2026-0006. There’s no workaround for this one, patching is the only real fix.
- If patching can’t happen immediately, pull vCenter off the public internet and restrict access to a segmented management network.
- Check logs for signs of earlier compromise, unfamiliar reverse shell tools, new scheduled tasks, or admin accounts you don’t recognize, since attackers have had roughly six weeks of potential access already.
- Treat any instance that’s been internet-facing and unpatched since late July as potentially compromised, not just vulnerable.
This is the same pattern that’s played out with other high-severity path traversal and RCE bugs this year, including GitLab’s maximum-severity path traversal flaw and the actively exploited Gitea RCE flaw CISA flagged in August: a patch ships, exploitation follows within days, and the window between disclosure and real damage keeps shrinking. Infrastructure that touches production, whether it’s a Git server, a CI pipeline, or a virtualization control plane like vCenter, needs the same patch discipline as public-facing web applications. It’s worth pairing that with the kind of infrastructure hardening covered in our note on the Cloudflare Spectre attack on Workers, since both stories point to the same gap: management and edge infrastructure doesn’t get the same scrutiny as the application layer until something like this forces the issue.
