DEV Community

Anoymask
Anoymask

Posted on

VMware vCenter CVE-2026-59310: Active Exploitation of Unauthenticated RCE for Persistent Reverse SSH

#security #threatintel

VMware vCenter CVE-2026-59310: Active Exploitation of Unauthenticated RCE for Persistent Reverse SSH

1. Basic Information

2. Executive Summary

Five days after the patch release, attacks were observed exploiting a directory traversal vulnerability in internet-reachable vCenter Syslog Servers. Attackers achieved unauthenticated remote code execution, used cron to launch an open-source reverse_ssh client, and maintained outbound SSH C2 connections.

3. Attack Flow

  1. The attacker connects over the network to an unpatched vCenter Syslog Server.
  2. The attacker exploits the CVE-2026-59310 directory traversal flaw to achieve arbitrary code execution on vCenter without authentication.
  3. The attacker creates a malicious cron job for persistence.
  4. The attacker deploys and launches an open-source reverse_ssh client.
  5. An outbound reverse SSH connection is established from vCenter to the attacker's C2 server, bypassing inbound firewall rules to maintain a remote shell.
  6. Public reports do not describe subsequent successful ESXi/VM operations, credential theft, or lateral movement.

4. Attacker Position and Execution Location

  • The attacker connects to the vCenter Syslog Server from the external network.
  • The exploit, cron job, and reverse_ssh run on the vCenter Server appliance.
  • The C2 server is external, and the connection originates outbound from vCenter.
  • Although vCenter is the centralized management plane for ESXi and VMs, public data shows no evidence of actual impact on managed targets.

5. Visibility for Victims and Administrators

  • Unauthenticated abnormal Syslog Server requests, directory traversal patterns, and unexpected processes or files on vCenter are visible.
  • New or modified cron entries and unusual reverse_ssh processes remain.
  • Long-running SSH-like traffic from vCenter to unknown hosts occurs even without inbound sessions.
  • Finding a vulnerable vCenter or a reverse_ssh binary alone does not confirm successful CVE exploitation. Analysts must check timestamps, parent processes, cron jobs, and outbound C2 traffic together.

6. Conditions for Success and Failure

Success Conditions

  • Affected versions of the vCenter Syslog Server are reachable by the attacker.
  • The security patch is not applied.
  • File creation, cron modifications, and process execution after the exploit are not blocked.
  • Outbound communication from vCenter to the attacker's C2 is allowed.

Failure Conditions

  • The system is updated to a patched version.
  • The management plane is isolated from the internet and restricted to a trusted admin network only.
  • File, cron, and process changes on the vCenter appliance are detected and blocked.
  • Unknown SSH and tunnel destinations are blocked using an egress allowlist.
  • Broadcom provides no workaround, meaning mitigation steps cannot replace patching.

7. What Happens on Success

Unauthenticated code execution and a persistent remote shell are established on the vCenter appliance. Using vCenter management privileges and stored data to control ESXi and VMs is a severe subsequent risk, but public data does not confirm successful execution, so this is treated as an inference.

8. Observable Logs

  • Email: None.
  • Proxy/SWG/DNS: Outbound traffic from vCenter to unknown C2, DNS resolution, and reverse SSH connections.
  • Endpoint/EDR: reverse_ssh, unknown binaries, cron modifications, shells, and file creation on vCenter. If the appliance lacks EDR, use OS auditing or FIM instead.
  • Identity/IdP: Initial exploitation requires no authentication. Subsequent new sessions, tokens, or role changes if vCenter accounts or APIs are used.
  • SaaS/Cloud: vSphere API tasks, ESXi host/VM operations, snapshots, and credential/secret access.
  • Network: Malicious requests to the Syslog Server, long-running outbound connections from vCenter, and abnormal east-west traffic from the management network.

9. Determining Attack Success

  • Contact Only: Scans or malicious requests only, with no server-side artifacts.
  • Initial Execution Suspected: Unknown files/shells on vCenter, and errors/requests at the matching timestamp.
  • RCE Confirmed: Exploit requests and corresponding process/file generation confirmed in the same timeline.
  • Persistence/C2 Confirmed: Malicious cron jobs, reverse_ssh execution, and outbound C2 sessions.
  • Subsequent Compromise: Confirmed vSphere tasks, ESXi/VM modifications, or credential usage (not confirmed in public data).

10. Investigation Playbook

  • Trigger: CVE-2026-59310 exploit patterns, unknown vCenter cron jobs, reverse_ssh, and outbound SSH/tunnels.
  • Initial Check: Confirm the vCenter version/build, patch time, external reachability, and initial malicious request.
  • Endpoint: Preserve cron jobs, process trees, filesystems, shells/audits/syslogs, binary hashes, and network sockets.
  • Authentication/Cloud: Check vCenter sessions, SSO tokens, roles, API tasks, ESXi trust, and backup/snapshot operations.
  • Subsequent Operations: Investigate host additions/deletions, VM power states, snapshots, guest tools, datastores, credential exports, and lateral movement.
  • Containment: Isolate the vCenter management plane, block C2 traffic, apply patches, rotate credentials/certificates, rebuild compromised appliances, and investigate managed targets broadly.
  • Judgment Categories: Scanned / Exploit Attempted / RCE Confirmed / Persistence-C2 Confirmed / Management Plane Compromised / ESXi-VM Impact Confirmed.

11. Defense and Detection Ideas

  • Single Event: reverse_ssh on vCenter, unknown cron jobs, and Syslog Server traversal requests.
  • Timeline Correlation: Unauthenticated request -> file/process -> cron -> reverse SSH egress -> vSphere API task.
  • Hunting: Check all vCenter versions, cron differences, unknown ELF binaries, outbound SSH, and traffic after the disclosure date of 2026-08-03.
  • Log Gaps: Appliance EDR, full command lines, Syslog Server requests, egress traffic, and vSphere task retention logs are often missing.
  • Priority Countermeasures: Update to versions 9.1.0.0300, 9.0.2.0100, 8.0 U3k / U2f or later, isolate the management plane, and apply egress allowlists.

12. Facts / Inference / Hypothesis

Facts

  • CVE-2026-59310 is a directory traversal vulnerability in the vCenter Syslog Server that leads to unauthenticated arbitrary code execution. The CVSS score is 9.8.
  • Broadcom released a patch on 2026-07-29, and there is no workaround.
  • Callbacks were observed starting 2026-08-03, and public reports counted 361 victim IPs across 47 countries by 2026-08-07.
  • Attackers used cron and the open-source reverse_ssh client.
  • 361 IPs do not necessarily equal 361 distinct organizations.

Inference

  • Because reverse SSH uses outbound connections, inbound firewalls alone cannot stop the C2 traffic.
  • vCenter compromise can potentially lead to ESXi/VM control, but public data has not confirmed this success.

Hypothesis

  • Due to rapid active exploitation and the high value of centralized management planes, multiple threat actors, including advanced groups, may use the same vulnerability.
  • QUIRSO suspects APT involvement, but public evidence alone cannot confirm attribution.

13. MITRE ATT&CK Mapping

  • High Confidence: T1190 Exploit Public-Facing Application, T1059.004 Unix Shell, T1053.003 Cron, T1105 Ingress Tool Transfer, T1572 Protocol Tunneling.
  • Medium Confidence: T1071.004 DNS (if C2 name resolution is confirmed), T1090 Proxy, T1210 Exploitation of Remote Services (if subsequent lateral movement is confirmed).

14. Unknowns and Further Investigation

  • Full formats of exploit requests and payloads, and the complete set of compromised binaries/C2 IOCs.
  • Execution privileges and whether vCenter SSO/certificates/credentials were accessed.
  • Actual subsequent operations on ESXi/VMs, data theft, and destructive activities.
  • Attacker attribution and the exact number of organizations included in the 361 IPs.

15. Impact on Organizations and SOCs

vCenter is a centralized management point for virtual infrastructure, making timely updates critical for organizations across industries such as manufacturing, finance, healthcare, and public sectors. Because there is no workaround, patching is the highest priority. Since exploitation began days after disclosure, organizations must conduct emergency changes and post-incident hunting instead of waiting for regular patch cycles.

16. Summary by Role

  • For SOCs: Distinguish between exploit attempts and successful RCE/cron/C2 establishment, and track up to vSphere tasks.
  • For Administrators: Update immediately to patched versions, isolate vCenter, restrict egress traffic, and check credentials and certificates.
  • For Users: General users do not need to take action. Report any virtual infrastructure anomalies or VM outages to administrators.

Top comments (0)