Unspecified attackers are actively exploiting a critical 9.8 directory traversal flaw in VMware vCenter systems across 361 unique victim IP addresses in 47 countries, primarily in Germany, the United States, Turkey, Iran, and France.In an Aug. 10 blog post, German cybersecurity company Quirso, said a threat actor has been exploiting CVE-2026-59310 and using reverse secure shell (SSH) to maintain access to compromised systems, based on evidence compiled during a recent incident response case.A directory traversal vulnerability lets an attacker manipulate file paths to reach directories and files they should never touch, then execute code across and enterprise’s virtual environment.“Because vCenter serves as the nerve center of most organizations' virtualization infrastructure, once it’s compromised, an attacker controls every virtual machine, every host, every snapshot in the environment,” said Denis Calderone, chief technology officer at Suzu Labs. Justin Beals, founder and CEO of Strike Graph, said what's alarming here isn't the patch cycle, Broadcom shipped a fix. Beals said the problem is 361 compromised systems across 47 countries just five days after disclosure.“That gap between patch release and organizational response is where every real breach lives,” said Beals. “VMware vCenter sits at the center of enterprise virtualization, so a compromise there is never contained to one server. It's a foothold into everything that server touches.”Beals said patching fast matters, but patching alone won't save a team if they can't verify the patch actually closed the door.“Teams need to confirm remediation, watch for persistence mechanisms like the reverse_ssh tool flagged in this campaign, and treat vCenter with the same scrutiny they'd apply to a domain controller,” said Beals. “Expect this activity to keep growing before it slows down. Attackers already have a five day head start, and most organizations haven't caught up yet."Jason Soroko, a senior fellow at Sectigo, said security teams should treat this as both a patching event and an incident-response event. Soroko said vCenter serves as the control plane for ESXi hosts: virtual machines, storage, permissions, and other parts of the virtualization estate, so its compromise can give an attacker leverage beyond one server.Soroko said Quirso’s reported attack chain used a cron job (time-based task scheduler) and reverse_ssh to create an outbound connection to attacker infrastructure. Soroko said that matters because controls designed to block inbound SSH may not stop a compromised vCenter appliance from calling out.“Patching closes the entry point, but it does not remove persistence that may already exist,” said Soroko. “There are therefore two clocks to manage: closing the vulnerability and evicting any attacker who entered before the patch. Teams should update vCenter, restrict access to its management services, and examine cron entries, processes, files, authentication records, and outbound connections for signs of compromise.“
Network Security, Cloud Security
Critical VMware vCenter flaw actively exploited in 47 countries
(Adobe Stock)
An In-Depth Guide to Network Security
Get essential knowledge and practical strategies to fortify your network security.
Related Events
Get daily email updates
SC Media's daily must-read of the most current and pressing daily news
You can skip this ad in 5 seconds