VMware vCenter Flaw Actively Exploited for Persistent Remote Access
Threat actors are actively weaponizing a critical directory-traversal vulnerability in Broadcom VMware vCenter (CVE-2026-59310, CVSS 9.8) to establish persistent remote access on compromised servers, according to German cybersecurity firm QUIRSO. The exploitation campaign was uncovered during an incident response engagement and has already impacted approximately 361 unique victim IP addresses across 47 countries, with Germany, the United States, Turkey, Iran, and France accounting for the majority of infections. Compromised hosts first reached out to attacker-controlled domains on August 3—just five days after Broadcom publicly disclosed the flaw—reinforcing the suspicion that the disclosure itself triggered the wave of attacks.
The attack chain leverages path traversal against vulnerable vCenter appliances to achieve arbitrary code execution, followed by the deployment of a malicious cron job that installs reverse_ssh, an open-source tool enabling outbound SSH tunnels to threat actor infrastructure. This persistence mechanism is particularly dangerous because it initiates connections from inside the network perimeter, effectively bypassing firewalls and intrusion detection systems designed to block unsolicited inbound traffic. QUIRSO researchers note that while reverse_ssh alone should not be treated as definitive proof of compromise, its presence on a vCenter appliance—especially in combination with unauthorized installation or unexpected outbound connections—warrants immediate investigation.
Attribution remains unconfirmed, but the tooling and tradecraft closely mirror campaigns attributed to Chinese state-sponsored groups. UNC5174 has previously exploited VMware Tools and vCenter flaws in espionage operations, and SentinelOne documented a related cluster called PurpleHaze in April 2025 that deployed a GoReShell backdoor leveraging reverse_ssh functionality. The campaign also coincides with a spike in scanning activity against VMware vCenter detected by Defused Cyber, which observed aggressive fingerprinting targeting CVE-2026-59309 (also CVSS 9.8), suggesting multiple vulnerabilities are being probed simultaneously. Security teams running unpatched vCenter instances should assume exposure and audit their appliances immediately.
Administrators should prioritize patching CVE-2026-59310 and CVE-2026-59309, hunt for rogue cron jobs and unauthorized reverse_ssh binaries on VMware appliances, and review outbound network flows for anomalies. Use a port scanner to verify that vCenter management interfaces (default TCP 443) are not inadvertently exposed to the internet, and run a WHOIS lookup on any suspicious outbound domains flagged in proxy or firewall logs to assess infrastructure ownership. A privacy checkup can further help identify exposed network services and credentials that could facilitate lateral movement from a compromised vCenter host into broader enterprise environments.