CISA gave federal agencies three days to fix a vCenter directory traversal flaw. A German incident response firm has since mapped 361 victim IP addresses across 47 countries, with a persistence chain deep enough that patching does not remediate it. Broadcom’s advisory, now at its third revision, still says nothing about exploitation at all — and this is not the zero-day it is being called.
What happened
CVE-2026-59310 is a directory traversal vulnerability in the vCenter Syslog server leading to arbitrary code execution. Broadcom’s own description, as the CNA: “VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.” CWE-22, CVSS 9.8.
It arrived in VMSA-2026-0006, published 29 July 2026, now at revision .2. The advisory covers five CVEs across ESX, vCenter, Workstation, and Fusion. A companion flaw, CVE-2026-59309, is an authentication bypass in VMware Directory Service, also scored 9.8. There are no workarounds for any of them. Both vCenter flaws are credited to Phil Brass and Matt South of Atredis Partners.
Fixed versions for vCenter Server:
- 9.1.x → 9.1.0.0300
- 9.0.x → 9.0.2.0100
- 8.0 through U3j → 8.0 U3k, or express patch 8.0 U2f
- 7.0 → no build listed; the advisory says contact Broadcom Support. This guidance was added only at revision .2 on 19 August, three weeks after the original advisory.
Cloud Foundation, vSphere Foundation, Telco Cloud Infrastructure and Telco Cloud Platform are also in scope. Note that CVE-2026-59309 was first fixed in 9.1.0.0200, but 9.1.0.0300 is the current build.
CISA added CVE-2026-59310 to the Known Exploited Vulnerabilities catalog on 18 August, with a remediation deadline of 21 August — a three-day window, citing BOD 26-04 rather than the familiar BOD 22-01. CISA’s own enrichment record sets the exploitation status to Active, automatable, with total technical impact.
The patch gap is the story
QUIRSO, a German DFIR firm, published a campaign timeline that is the most useful thing written about this flaw. Advisory published 29 July. First signs of CVE-2026-59309 exploitation on 1 August. First victim callbacks for CVE-2026-59310 on 3 August — five days after the fix was available. Roughly 95% of the eventual victims were compromised by 5 August.
That is a one-week window between a public patch and mass compromise, and it is the number worth carrying into your next patching conversation. The failure mode here was not an unknown flaw. It was a known flaw on an appliance nobody had a maintenance window for.
QUIRSO counts 361 unique victim IP addresses across 47 countries. The top five: Germany (55), the United States (41), Turkey (38), Iran (26), France (25). None in mainland China.
What the attackers leave behind
From a single incident response engagement on one compromised appliance, QUIRSO documents a persistence chain with heavy redundancy:
- reverse_ssh, an open-source SSH-based remote access tool, making outbound connections to attacker infrastructure for shell, file transfer, and network forwarding
- A systemd service,
sys-9436d8.service, continuously restarting a backdoor binary namedlinuxFilein/root/.local/share/cg4nQW9TOxeq/ - Cron jobs masquerading as legitimate VMware tasks:
vmware-vpxd-stats-*,vmware-perf-collect-*,vmware-perf-sync-* - A JSP webshell,
vmware-perf-update.jsp, dropped into Perfcharts directories - Root SSH keys appended to
authorized_keys, plus sudoers entries granting passwordless sudo - Rogue SSO administrator accounts:
adminuser,vcadmin,svc_<ID>
Six independent footholds, three of them named to blend into VMware’s own scheduled work. Applying the patch removes none of them.
On attribution, QUIRSO assesses “with moderate confidence that the exploitation campaign targeting CVE-2026-59310 is operated by a Chinese-speaking threat actor,” citing Chinese-language artifacts, tooling, victimology, and UTC+8 activity patterns. They are explicit about the limits: “QUIRSO currently has insufficient evidence to associate the campaign with a named Chinese threat group or determine that it is directed by the Chinese state.” We are reporting that as they wrote it.
Three things the coverage is getting wrong
Broadcom has not confirmed exploitation. VMSA-2026-0006 contains no exploitation statement through revision .2, published 19 August — one day after the KEV listing. The word “exploit” appears only in the generic “a malicious actor may exploit this issue” phrasing that every advisory carries. Any sentence of the form “Broadcom warned that attackers are exploiting” or “VMware confirmed active exploitation” is wrong. The parties asserting exploitation are CISA and QUIRSO.
This is not a zero-day. Several outlets have run it as one. By QUIRSO’s own timeline, exploitation began five days after the patch shipped. That is patch-gap exploitation, which is a different problem with a different fix — and frankly a more uncomfortable one, because it is entirely within your control.
The ransomware claim has no source. At least one aggregator asserts Babuk-derived ransomware in connection with this CVE, attributing it to “social media reports.” QUIRSO’s own forensic report describes no ransomware whatsoever. We are not running it, and neither should anyone else without something to point at.
What to do
- Patch to the builds above. On 7.0, you need to contact Broadcom Support — there is no published build, and that guidance did not exist until three weeks after the advisory.
- If your vCenter was network-reachable and unpatched at any point between 29 July and now, hunt before you assume you are fine. Look for unexpected systemd services, cron entries impersonating VMware tasks, JSP files in Perfcharts directories, additions to root’s
authorized_keys, sudoers modifications, and SSO administrator accounts nobody created. - Rotate SSO credentials on any appliance you cannot rule out.
- Do not treat patching as remediation. The documented persistence survives it, by design.
Sourcing note
The CVE description and CVSS come from Broadcom as CNA; NVD carries no independent primary score. KEV add and due dates were confirmed through NVD’s mirrored CISA fields and a second catalog mirror, as cisa.gov itself is not retrievable from here. Exploitation is asserted by CISA and by QUIRSO, not by Broadcom, whose advisory remains silent. The 361 figure counts unique victim IP addresses observed contacting attacker infrastructure — it is not 361 forensic investigations, and the detailed persistence chain above comes from a single IR case. Attribution is QUIRSO’s, at moderate confidence, with the firm itself stating it cannot tie the activity to a named group or to state direction. An earlier Rapid7 assessment finding no evidence of exploitation predates both the QUIRSO report and the KEV listing and should not be quoted as current. We could not verify the KEV catalog’s ransomware-use flag for this entry.