Critical VMware vCenter Vulnerability in Attackers’ Crosshairs
Threat actors have started exploiting a recently patched critical-severity vulnerability in VMware vCenter, rapid incident response company Quirso reports.
The bug was disclosed on July 29, when Broadcom patched it alongside four other security defects in multiple VMware products.
Tracked as CVE-2026-59310 (CVSS score of 9.8), the flaw is described as a directory traversal issue in the Syslog server that leads to remote code execution.
“A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code,” Broadcom’s advisory reads.
According to Quirso, an advanced persistent threat (APT) actor has been exploiting web-accessible VMware vCenter servers vulnerable to CVE-2026-59310, using a reverse shell for persistent access.
The cybersecurity company identified over 360 victim IP addresses across 47 countries, half of which are distributed across only five countries: Germany, the US, Turkey, Iran, and France.
Advertisement. Scroll to continue reading.
“The exact number of victim organizations cannot...
Copyright of this story solely belongs to securityweek.com. To see the full text click HERE
