Broadcom VMware vCenter — Active Exploitation of Directory Traversal and Remote Code Execution Flaw (CVE-2026-59310)

Publication date: August 12, 2026
Category: Threat Intelligence / Vulnerability Analysis

Introduction

Recent intelligence findings published by cybersecurity firm QUIRSO have raised urgent alerts following the active in-the-wild exploitation of a recently patched critical security flaw in Broadcom VMware vCenter, tracked as CVE-2026-59310. Threat actors are weaponizing this vulnerability to achieve persistent remote access across critical enterprise infrastructures globally. Simultaneously, security monitoring teams have identified a parallel spike in version-probing and scanning activities targeting a second critical authentication bypass flaw, CVE-2026-59309. This unfolding scenario highlights a coordinated or opportunistic campaign by advanced persistent threat (APT) groups focusing on highly privileged virtualization appliances.

What is VMware vCenter and the Affected Vulnerabilities? (General Analysis)

VMware vCenter Server is the centralized management platform for VMware vSphere virtualized environments, enabling administrators to centrally control multiple ESXi hosts, virtual machines, and storage resources from a single unified interface. Given its critical position within enterprise networks, compromising a vCenter server grants malicious actors complete administrative dominance over the underlying virtual infrastructure.

The core vulnerabilities analyzed in this threat cycle are:

  • CVE-2026-59310 (Verified NVD Data): A directory traversal vulnerability residing in the VMware vCenter Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code. It carries an official CVSS v3.1 score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. It is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.
  • CVE-2026-59309 (Verified NVD Data): An authentication bypass vulnerability within the VMware Directory Service (vmdir). A malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized access to the system. It carries an official CVSS v3.1 score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and is classified under CWE-303 (Incorrect Implementation of Identification/Authentication Algorithm).

How Does It Work? (Technical Analysis)

The attack chain uncovered by forensic researchers details a structured sequence of tactical steps aimed at consolidating control over the compromised appliance:

  • Initial Infection Flow / Exploit Entry: The attacker leverages the directory traversal flaw (CVE-2026-59310) within the vCenter Syslog component to manipulate file paths without requiring prior authentication (PR:N, UI:N, AV:N). This facilitates the indirect writing or execution of malicious payloads by taking advantage of input validation weaknesses in path handling.
  • Persistence Mechanisms and Code Execution: Following initial access, forensic artifacts revealed the deployment of malicious cron jobs. These scheduled tasks invoke reverse_ssh, an open-source utility designed to establish outbound SSH tunneling connections back to threat actor-controlled infrastructure.
  • Perimeter Evasion via Outbound Connections: The utilization of reverse_ssh serves as a highly effective persistence vector. By initiating outbound connections from the compromised appliance outward, operators successfully bypass traditional perimeter security controls configured to block suspicious inbound traffic requests.
  • Parallel Reconnaissance and Probing (CVE-2026-59309): In parallel with the confirmed exploitation of the Syslog vector, other cybersecurity vendors have recorded automated scanning and fingerprinting probes issuing POST requests to /sdk/ (RetrieveServiceContent) and traversing the SAML SSO flow (/websso), pointing toward potential large-scale exploitation efforts targeting the vmdir authentication bypass flaw.

Affected Systems / Environments

The vulnerabilities impact multiple unpatched versions of VMware vCenter Server running configurations prior to the security advisories released by Broadcom in late July 2026 (VMSA-2026-0006).

CVE Category (CWE) Impact CVSS Vector (summarized)
CVE-2026-59310 CWE-22 (Path Traversal) Arbitrary Code Execution / Full Access 9.8 (CRITICAL) AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2026-59309 CWE-303 (Auth Bypass) Authentication Bypass / Unauthorized Access 9.8 (CRITICAL) AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Hundreds of unique victim IP addresses have been identified across 47 countries, with the majority concentrated in Germany, the United States, Turkey, Iran, and France.

Mitigation and Detection

Remediation

  • Apply Official Vendor Patches: Immediately apply the software updates and security advisories provided by Broadcom (VMSA-2026-0006) to remediate the vulnerabilities in vCenter Server.
  • Network Segmentation and Hardening: Isolate vCenter management appliances within strictly controlled management network segments, restricting external network access and limiting administrative traffic exclusively to secure, multi-factor authenticated (MFA) VPN tunnels.

Detection

  • Monitor for Anomalous Outbound Connections: Actively hunt for child processes executing tunneling utilities such as reverse_ssh or unexpected outbound network connections toward non-standard SSH ports originating from vCenter servers.
  • Log Forensic Review: Audit system logs for unusual HTTP requests targeting /sdk/ endpoints or anomalies within Syslog services indicative of path traversal exploitation attempts.

“The presence of reverse_ssh in combination with unauthorized installation or unexpected outbound connections on a vulnerable vCenter appliance is a high-priority indicator requiring immediate investigation.”

bash 
# Conceptual rule example for hunting suspicious reverse_ssh processes on Linux/vCenter hosts
ps aux | grep -E "reverse_ssh|ssh.*-R.*:"

Wrapping Up

The rapid weaponization of CVE-2026-59310 in VMware vCenter shortly after public disclosure illustrates the swift pace at which threat actors operationalize critical flaws in core enterprise infrastructure software. The combination of directory traversal for code execution and outbound SSH tunneling for persistence emphasizes the critical necessity of rigorous patch management routines and continuous defensive monitoring across enterprise virtual environments.

References