Loading story…
Ransomware operators are exploiting CVE-2026-59310, a critical unauthenticated VMware vCenter Server flaw in the Syslog server, to compromise vCenter management infrastructure and encrypt managed ESXi virtual machines with Babuk-derived payloads. Broadcom patched the vulnerability on July 29, but successful exploitation was observed within five days; reported activity affected 361 victim IP addresses across 47 countries. No ransomware group has been publicly identified.
Initial intrusions used reverse-SSH tunnels and cron-job persistence, activity assessed as likely associated with an advanced persistent threat actor before ransomware deployment emerged. CISA has added the 9.8-CVSS vulnerability to its Known Exploited Vulnerabilities catalog and warned of ransomware use. Organizations should urgently install VMware's latest cumulative updates, remove vCenter interfaces from direct internet exposure, limit administration to trusted networks and jump hosts, and investigate formerly exposed or unpatched vCenter instances for persistence and unauthorized access.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
CISA warned that ransomware groups were exploiting CVE-2026-59310 against VMware vCenter. Reporting indicated that operators used compromised vCenter instances to deploy Babuk-derived ransomware payloads that encrypt managed ESXi virtual machines; no specific ransomware group was publicly named.
CISA added CVE-2026-59310 to its Known Exploited Vulnerabilities catalog and required U.S. federal civilian agencies to remediate it by August 21. CISA also designated the issue for forensic triage, signaling that affected organizations should investigate for compromise as well as patch.
By August 5, QUIRSO had observed approximately 343 of 361 unique victim IP addresses associated with the CVE-2026-59310 campaign. The addresses spanned 47 countries, though the researchers cautioned that IP addresses did not necessarily represent distinct victim organizations.
QUIRSO observed the first successful compromises linked to CVE-2026-59310 five days after patches became available. The campaign was assessed as likely tied to an advanced persistent threat actor and used malicious cron jobs and reverse_ssh tunnels for persistence and outbound access.
Broadcom disclosed and released patches for CVE-2026-59310 in advisory VMSA-2026-0006. The unauthenticated CVSS 9.8 directory-traversal flaw in vCenter's Syslog server could allow network-accessible attackers to execute arbitrary code; the advisory also addressed CVE-2026-59309.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
cybercenter.space
Open sourcescworld.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical **VMware vCenter** directory traversal flaw, tracked as `CVE-2026-59310`, is being actively exploited to achieve unauthenticated remote code execution through the vCenter Syslog Server component. Broadcom disclosed the issue and released emergency patches, warning that any attacker with network access to a vulnerable system could run arbitrary code. No workaround was provided, leaving patching and exposure reduction as the primary defenses for affected vCenter deployments. Incident responders at QUIRSO reported exploitation beginning shortly after disclosure and said attackers are deploying the open-source **`reverse_ssh`** tool to establish outbound command-and-control channels and maintain persistence. The firm counted **361 victim IP addresses across 47 countries** within days, while administrators on r/sysadmin amplified warnings to patch immediately and noted that internet-exposed or poorly isolated vCenter instances remain especially vulnerable. QUIRSO said the activity may be linked to an APT actor, though it has not publicly released supporting evidence and is coordinating indicators with law enforcement.
Aug 19, 2026
**CISA added CVE-2024-37079, a critical VMware vCenter Server vulnerability, to its Known Exploited Vulnerabilities (KEV) Catalog after Broadcom indicated it has evidence of in-the-wild exploitation.** The flaw is a **9.8 CVSS** out-of-bounds write/heap-overflow issue in vCenter Server’s **DCERPC** implementation; an attacker with network access can send specially crafted packets that may result in **remote code execution (RCE)**. CISA’s KEV entry does not attribute exploitation to a specific threat actor and lists ransomware use as **unknown**, but the KEV addition triggers mandatory remediation timelines for US federal agencies. Reporting also noted CISA added multiple other enterprise software issues to KEV in a short span (including vulnerabilities affecting **Versa Concerto** and **Zimbra**, plus developer tools), but the vCenter Server item drew specific attention because it was **patched by Broadcom in 2024** and is still being exploited. Broadcom has not publicly provided details on the scope, victims, or exploitation chain beyond acknowledging observed exploitation, reinforcing the need for organizations running vCenter Server to validate exposure and ensure the relevant updates are deployed.
Jun 29, 2026
The U.S. Cybersecurity and Infrastructure Security Agency (**CISA**) updated its Known Exploited Vulnerabilities (**KEV**) catalog to indicate that **CVE-2025-22225**, a high-severity VMware ESXi *VMX sandbox escape* flaw, is now **known to be used in ransomware campaigns**. Broadcom patched the issue in March 2025 as part of advisory `VMSA-2025-0004`, describing CVE-2025-22225 as an **arbitrary kernel write** reachable by an attacker with privileges in the `VMX` process, enabling escape from the VMX sandbox to the ESXi kernel. The same advisory also addressed two other zero-days—**CVE-2025-22224** (TOCTOU leading to out-of-bounds write/code execution as the VMX process) and **CVE-2025-22226** (HGFS out-of-bounds read/memory disclosure)—which Broadcom previously tagged as actively exploited in the wild. Reporting also tied the ESXi exploitation to earlier sophisticated activity: Huntress described Chinese-speaking threat actors leveraging access via a compromised SonicWall VPN to deliver tooling targeting VMware ESXi and chaining a VM escape technique that appeared to predate public disclosure of the March 2025 ESXi zero-days. Separately, GreyNoise research highlighted a broader KEV-catalog visibility gap, finding that CISA **quietly “flipped”** dozens of KEV entries during 2025 from “Unknown” to “Known” for ransomware use without prominent public notification—an approach that can materially affect enterprise prioritization when a vulnerability’s status changes to confirmed ransomware exploitation.
Jun 29, 2026