VMware vCenter: CVE-2026-59310 exploited

Active exploitation in vCenter

Telconet CSIRT said advanced threat actors are actively exploiting CVE-2026-59310 in VMware vCenter, a flaw rated CVSS 9.8. The team described it as a directory traversal vulnerability in VMware vCenter Syslog Server that can lead to unauthenticated remote code execution in the Syslog component.

According to the same bulletin, the impact can extend to system-level access and enable persistence through reverse_ssh. That combination makes the issue especially sensitive in internet-facing environments, where active exploitation has already been observed.

Patch available, no workaround

Hispasec’s coverage said Broadcom released fixes for CVE-2026-59310 in advisory VMSA-2026-0006.1. It also noted that there is no workaround, so the recommended mitigation is to apply the vCenter updates.

Daily.dev also reported that Broadcom released a patch on 2026-07-29 and that the fixed versions for vCenter are 9.1.0.0300, 9.0.2.0100, and 8.0 U3k/U2f.

Reported victims and persistence

Shadowserver published a special victim report for CVE-2026-59310 on 2026-08-12 based on QUIRSO identifications. The foundation said the reported systems should be considered fully compromised, because in every reported case the reverse_ssh persistence mechanism was deployed.

A secondary report attributed to the DFIR firm QUIRSO the figure of 361 compromised IPs across 47 countries as of 2026-08-07, although that number was presented as not officially confirmed. Telconet’s bulletin provides the closest regional reference in the available material, but there is no broad independent attribution for Latin America in the sources reviewed.