From Unauthenticated RCE to Ransomware: The vCenter Syslog Flaw That Reached 47 Countries

Broadcom published VMSA-2026-0006 on July 29, 2026, fixing five issues across ESX, vCenter, Workstation, and Fusion. Two of the vCenter bugs carried a CVSS score of 9.8. One of them, CVE-2026-59310, is a directory traversal in the vCenter Syslog service that allows an unauthenticated attacker to execute code. On September 15, 2026, CISA updated the KEV entry to mark it as used in known ransomware campaigns.

The gap between disclosure and exploitation was five days.

The flaw and the initial access

CVE-2026-59310 lives in the vCenter Syslog service. A directory traversal lets an attacker write files outside the intended directory and then execute them, without authenticating. The companion bug, CVE-2026-59309, is an authentication bypass in the VMware Directory Service and also scores 9.8.

Broadcom states there is no workaround. Upgrading is the only remediation. Fixed versions are vCenter 9.1.0.0300, 9.0.2.0100, and 8.0 U3k or U2f, with corresponding Cloud Foundation updates.

Attribute	Value
CVE	CVE-2026-59310
CVSS	9.8
Type	Directory traversal leading to unauthenticated RCE
Component	vCenter Syslog service
Vendor advisory	VMSA-2026-0006, July 29, 2026
Fixed versions	9.1.0.0300, 9.0.2.0100, 8.0 U3k / U2f
Workaround	None

What the intrusion looked like

QUIRSO, a German incident response firm, confirmed that attacks began on August 3, five days after the patch. By its August 10 report, it had recorded 361 victim IP addresses across 47 countries, with Germany (55), the United States (41), Turkey (38), Iran (26), and France (25) accounting for roughly half.

The observed chain ran through several stages:

• Exploit the directory traversal to write and execute arbitrary code.
• Plant a cron job for persistence.
• Deploy the open-source reverse_ssh tool to establish an outbound command-and-control channel, which bypasses defenses that only inspect inbound traffic.
• Create administrator accounts and use the vSphere API for discovery.
• On some victims, deploy Babuk-derived ransomware with the .babyk extension and encrypt ESXi logs.

QUIRSO attributed the activity to a Chinese-speaking actor with medium confidence, based on Chinese-language artifacts in scripts, tool reuse, and activity aligned to UTC+8. Attribution carries uncertainty, and 361 victim IP addresses do not equal 361 victim organizations.

Why vCenter is the target

vCenter is the control plane for a virtualized environment. Compromise it and the attacker can reach every managed host, virtual machine, and snapshot. The Cloud Security Alliance noted that this concentration of control is exactly what makes the platform attractive.

The reverse_ssh step deserves attention. An outbound connection from the management plane looks like normal egress traffic to many networks, so a persistent channel can survive for weeks.

Detection and remediation

• Upgrade vCenter to a fixed version and update Cloud Foundation components in step. Restart cluster services and verify VM state, account permissions, and scheduled tasks afterward.
• Never expose vCenter to the internet. Restrict port 443 to a bastion host or a fixed set of management IP addresses.
• Hunt for anomalous cron entries, reverse_ssh outbound connections, and unexpected writes by the Syslog service.
• In access.log, look for requests containing repeated ../ sequences, unknown POST requests that write files, and high-frequency access to management interfaces from non-operational IP addresses.
• Audit /etc/passwd for unfamiliar accounts, review crontab -l, and check for reverse tunnel processes.
• Review virtual machine snapshots for unexpected entries, since snapshots can serve as a persistence mechanism.

The shrinking patch window

The useful number here is five. That is how many days separated the Broadcom advisory from observed exploitation, and 95 percent of the victim IP addresses appear to have been hit before August 5. When a management plane bug is weaponized that quickly, patch planning measured in weeks does not apply. The realistic target is to close the exposure first, by removing internet reachability, and then schedule the upgrade.

References

• Broadcom VMSA-2026-0006, updated August 19, 2026.
• CISA Known Exploited Vulnerabilities Catalog, CVE-2026-59310, updated September 15, 2026.
• QUIRSO incident report on vCenter exploitation, August 10, 2026.
• Cloud Security Alliance research note on vCenter as a control plane target.
• The Hacker News coverage of Babuk-derived ransomware deployment on ESXi hosts.