VMware vCenter RCE Gives Attackers a Path From One Appliance to Entire Virtual Infrastructure

A critical VMware vCenter vulnerability is being actively exploited in a fast-moving campaign that turns a single exposed management appliance into a launch point for broad virtual-infrastructure compromise.

Incident responders at QUIRSO linked the activity to exploitation of CVE-2026-59310, while identifying a separate, possibly unrelated track involving CVE-2026-59309.

CVE-2026-59310 is a directory-traversal vulnerability in the VMware vCenter Syslog Server with a CVSS score of 9.8.

According to Broadcom’s advisory VMSA-2026-0006, a network-accessible attacker can abuse the vulnerability to achieve arbitrary code execution, and no workaround is available beyond applying the vendor’s fixed releases.

The campaign’s scale illustrates the exposure problem. QUIRSO identified 361 unique victim IP addresses across 47 countries, although the researchers cautioned that IP counts do not equal the number of compromised organizations because cloud, hosting and shared networks can front multiple customers.

Germany, the United States, Turkey, Iran and France accounted for 185 of the observed addresses.

By August 5, roughly 95% of the eventual victim set had already appeared, indicating high-speed, broad scanning and exploitation rather than a narrowly targeted operation.

On an investigated vCenter Server Appliance, attackers apparently transformed the Syslog Server path traversal into privileged cron execution.

Artifacts named zz-poc59310-syslog.log and zz-poc59310 were placed under /etc/cron.d/, with commands using curl or wget to retrieve payloads, assign executable permissions and run them as root.

The naming directly references the CVE and mimics syslog-file conventions, suggesting the actor used crafted log content to write attacker-controlled cron entries outside their intended path.

That initial foothold gave the intruders far more than appliance-level access. They staged backdoors from multiple servers, used /tmp/.x/ for payload storage and deployed the open-source reverse_ssh framework for outbound command-and-control.

QUIRSO observed exploitation against internet-facing vCenter deployments within five days of the July 29 disclosure, underscoring how quickly critical virtualization bugs are weaponized once technical details become public.

VMware vCenter Vulnerability

Reverse SSH supports remote shells, file transfer and network forwarding; because the connection originates from the compromised appliance, it can evade defenses centered on blocking unsolicited inbound traffic.

QUIRSO published a generic YARA rule for hunting reverse_ssh builds, but stressed that the tool is dual-use and requires correlation with suspicious execution, unauthorized installation and anomalous outbound traffic.

Persistence was layered. The operators reportedly created a root-owned systemd service, planted cron jobs masquerading as VMware components such as vmware-vpxd-stats-* and vmware-perf-collect-*, enabled SSH, inserted attacker-controlled keys and dropped a JSP web shell into the Perfcharts application path.

They also configured the legitimate perfcharts service account for passwordless root-level sudo, creating a secondary privilege route if direct root execution became unreliable.

The most consequential post-exploitation step was identity takeover. By recovering vCenter Directory Service machine credentials from vmdir configuration, the actor could create new SSO administrative accounts and query vSphere inventory through the API.

That converts control of the vCenter appliance into control over the plane that manages ESXi hosts, virtual machines, datastores and networks the ideal position for lateral movement, mass disruption and ransomware deployment.

QUIRSO also found August 1 activity consistent with exploitation of CVE-2026-59309, an authentication-bypass vulnerability in VMware Directory Service.

A newly created administrative account and unusual GoodMoodle-VCProbe/1.0 and GoodMoodle-VCFleet/1.0 user agents were observed, but researchers have not conclusively linked this activity to the CVE-2026-59310 intrusion chain.

Defenders should immediately apply the fixed vCenter versions specified in Broadcom’s VMSA-2026-0006 advisory and treat exposed, unpatched vCenter instances as potentially compromised.

Hunt for unexpected cron files, suspicious systemd units, changes to root SSH keys, anomalous SSO administrators, Perfcharts JSP files, and outbound connections from vCenter to unfamiliar infrastructure.

The campaign demonstrates why vCenter must be treated as Tier-0 infrastructure: compromise of one management appliance can rapidly become compromise of the entire virtual estate.

[Live Webinar] Join Elastic & UnderDefense to learn how small security teams can unify AI visibility and agentic response into one operating model. -> Register Now