VMware vCenter Flaw Exploited for Persistent Access

Threat actors are actively exploiting a recently patched critical vulnerability in Broadcom's VMware vCenter, according to German cybersecurity firm QUIRSO. The attacks leverage a directory-traversal flaw to execute arbitrary code and establish persistent remote access, with evidence pointing to a coordinated campaign that began shortly after the vendor's disclosure.

Critical Flaw Under Attack

The vulnerability, tracked as CVE-2026-59310, carries a CVSS score of 9.8, marking it as critical. It exists in the VMware vCenter server and allows an attacker with network access to exploit a directory-traversal condition to execute arbitrary code on the underlying system. Broadcom released patches for this flaw late last month, but the exploit activity indicates that unpatched systems remain at risk.

Attack Chain Details Revealed

QUIRSO discovered the exploitation during an incident response engagement. The attack chain involved path traversal activity consistent with CVE-2026-59310, followed by the deployment of a malicious cron job to establish persistence. The attackers used an open-source tool called reverse_ssh, which enables outbound SSH connections to threat actor-controlled infrastructure, allowing them to maintain access to compromised systems.

360+ Victims Across 47 Countries

QUIRSO identified 361 unique victim IP addresses spread across 47 countries, with the highest concentration in Germany, the U.S., Turkey, Iran, and France. The first contact from compromised systems to attacker domains occurred on August 3, just five days after Broadcom disclosed the vulnerability, suggesting a rapid exploitation timeline.

Timing Suggests Disclosure as Catalyst

QUIRSO noted that while the attacker might have had prior knowledge of the vulnerability, the strong correlation between the time of disclosure and the start of exploitation suggests that the disclosure served as the initial starting point for the campaign. This pattern is common in cases where threat actors race to exploit newly disclosed vulnerabilities before organizations can apply patches.

Potential APT Involvement

While the identity of the attackers remains unclear, QUIRSO believes the campaign is likely the work of a suspected advanced persistent threat (APT) actor. VMware appliances have historically been a lucrative target for Chinese threat actors such as UNC5174, who have previously weaponized security flaws in VMware Tools and vCenter for espionage campaigns. However, there is no confirmed link between this campaign and any known group.

Use of reverse_ssh Raises Red Flags

The use of reverse_ssh is notable because it allows attackers to establish outbound connections to their own endpoints, effectively bypassing security controls designed to block suspicious inbound traffic. QUIRSO cautioned that the presence of reverse_ssh alone is not proof of malicious activity, but when combined with unauthorized installation, unexpected outbound connections, or execution on a vulnerable vCenter appliance, it becomes a high-priority indicator requiring investigation.

"The presence of reverse_ssh should not, by itself, be treated as proof of malicious activity. In combination with unauthorized installation, unexpected outbound connections or execution on a vulnerable vCenter appliance, however, it is a high-priority indicator requiring investigation."

— QUIRSO, German cybersecurity company

Increased Scanning for Related Flaw

Separately, security firm Defused Cyber reported a spike in scanning activity against VMware vCenter that may indicate exploitation attempts targeting CVE-2026-59309, another critical flaw with a CVSS score of 9.8. Defused Cyber observed increased fingerprinting, including version probes via POST /sdk/ (RetrieveServiceContent) and walks of the /websso SAML SSO flow, coinciding with Broadcom's advisory VMSA-2026-0006.

Investigation Findings So Far

Denis Szadkowski, COO and co-founder of QUIRSO GmbH, told The Hacker News that there is not enough evidence at this stage to correlate the exploitation and scanning efforts using CVE-2026-59309 with the intrusion set or attacker infrastructure associated with CVE-2026-59310. "What we can say with much higher confidence is that the activity we investigated represents a successful compromise rather than merely exploitation attempts, and the forensic evidence strongly points toward CVE-2026-59310 as the initial access vector," Szadkowski added.

Organizations using VMware vCenter should prioritize applying the latest patches from Broadcom and monitor for indicators of compromise, particularly the presence of reverse_ssh or unexpected outbound connections.

Implications for Enterprises

The active exploitation of CVE-2026-59310 underscores the critical importance of timely patch management for infrastructure components like vCenter, which often serve as central management points in virtualized environments. The campaign's scale—361 victims across 47 countries—suggests that attackers are moving quickly to exploit known vulnerabilities, and the use of reverse_ssh indicates a sophisticated approach to maintaining persistence. Enterprises that have not yet patched should treat this as an urgent priority, as the window between disclosure and exploitation is narrowing.