Severity Daily

IT and AI security incidents, checked against the primary source

Tag: CVE-2026-59310

  • The vendor record understated the day, and a federal clock runs out tomorrow

    The vendor record understated the day, and a federal clock runs out tomorrow

    The most consequential item on the site today is a Citrix flaw that Citrix still describes as a crash. CVE-2026-8452 is in CISA’s Known Exploited Vulnerabilities catalog with a federal remediation deadline of tomorrow, Saturday 29 August, and two research teams have taken it from an unauthenticated SAML request to a root shell. Citrix’s bulletin CTX696604 has not been updated since 20 July and still calls it a denial-of-service bug. Internet-facing, pre-authentication, a clock that expires in hours, and a vendor description that invites you to defer it — that combination outranks the two items that sound bigger. McKesson filed an 8-K this afternoon and Carhartt’s breach is being counted in the millions. Neither gives anyone anything to do tonight. The NetScaler appliance does.

    The day had a real thread, and it is not a comfortable one: the vendor record kept failing to carry the risk. Citrix labels a root shell a denial of service. Broadcom’s vCenter advisory is at its third revision and still says nothing about exploitation, while a German DFIR firm has mapped 361 victim IP addresses across 47 countries. Microsoft published a CVSS 10.0 Entra ID flaw as exploited and then filed a one-line retraction that much of the coverage never followed. PaperCut’s emergency builds do not appear on PaperCut’s own release history. JFrog’s Artifactory flaw is on a federal clock that the July version most people patched to does not satisfy. And a CVSS 10.0 in ByteDance’s UI-TARS-desktop is remediated by a commit hash rather than a release. Six stories, one failure mode: anyone who triaged today from vendor severity text triaged it wrong.

    Order of business after NetScaler. If you run N-central on premises, or you buy from an MSP that does, that is your first item instead — N-able says in its own words that attackers used Take Control to reach managed endpoints and left Cloudflare tunnels behind, and two rounds of patching were insufficient. Then vCenter, where the persistence chain outlives the patch. Then the rest of the weekend’s clocks: a 2019 SQL Server bug also due tomorrow, though it needs a privileged login to work, and an ownCloud authentication bypass from 2023 plus a Linux kernel container escape due Sunday. PaperCut is under active attack with no CVE at all, which means no KEV entry and no deadline to force it onto anyone’s list.

    Below the clocks: three Langflow code-execution CVEs landed at NVD this evening with no workaround offered and 1.11.2 as the only fix. GPUThor is the day’s best research and the day’s most oversold coverage; it beat NVIDIA’s ECC on four workstation cards, not on the AI fleet. The GitLab exploitation claim rests on one firm’s honeypot data and GitLab has not addressed it; patch anyway, but do not carry the claim as confirmed. And two pieces on the record itself: BOD 22-01 has been dead since June, and this week’s KEV entries carry identical required-action text whether the deadline is three days or fourteen.

    Still open. McKesson’s filing does not say whether data left the company; the statement it gave reporters the same day does, and the two have not been reconciled. Carhartt has said nothing publicly, and the 12.9 million figure is a researcher’s correction, not a company number. Broadcom’s vCenter advisory has been revised twice since the first victim callbacks and still does not mention exploitation. PaperCut still has no CVE. Two federal deadlines land Sunday, on a weekend, which is its own kind of answer about how the three-day band is working.

  • vCenter servers are being backdoored five days after the patch, and Broadcom still hasn’t mentioned exploitation

    vCenter servers are being backdoored five days after the patch, and Broadcom still hasn’t mentioned exploitation

    CISA gave federal agencies three days to fix a vCenter directory traversal flaw. A German incident response firm has since mapped 361 victim IP addresses across 47 countries, with a persistence chain deep enough that patching does not remediate it. Broadcom’s advisory, now at its third revision, still says nothing about exploitation at all — and this is not the zero-day it is being called.

    What happened

    CVE-2026-59310 is a directory traversal vulnerability in the vCenter Syslog server leading to arbitrary code execution. Broadcom’s own description, as the CNA: “VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.” CWE-22, CVSS 9.8.

    It arrived in VMSA-2026-0006, published 29 July 2026, now at revision .2. The advisory covers five CVEs across ESX, vCenter, Workstation, and Fusion. A companion flaw, CVE-2026-59309, is an authentication bypass in VMware Directory Service, also scored 9.8. There are no workarounds for any of them. Both vCenter flaws are credited to Phil Brass and Matt South of Atredis Partners.

    Fixed versions for vCenter Server:

    • 9.1.x → 9.1.0.0300
    • 9.0.x → 9.0.2.0100
    • 8.0 through U3j → 8.0 U3k, or express patch 8.0 U2f
    • 7.0 → no build listed; the advisory says contact Broadcom Support. This guidance was added only at revision .2 on 19 August, three weeks after the original advisory.

    Cloud Foundation, vSphere Foundation, Telco Cloud Infrastructure and Telco Cloud Platform are also in scope. Note that CVE-2026-59309 was first fixed in 9.1.0.0200, but 9.1.0.0300 is the current build.

    CISA added CVE-2026-59310 to the Known Exploited Vulnerabilities catalog on 18 August, with a remediation deadline of 21 August — a three-day window, citing BOD 26-04 rather than the familiar BOD 22-01. CISA’s own enrichment record sets the exploitation status to Active, automatable, with total technical impact.

    The patch gap is the story

    QUIRSO, a German DFIR firm, published a campaign timeline that is the most useful thing written about this flaw. Advisory published 29 July. First signs of CVE-2026-59309 exploitation on 1 August. First victim callbacks for CVE-2026-59310 on 3 August — five days after the fix was available. Roughly 95% of the eventual victims were compromised by 5 August.

    That is a one-week window between a public patch and mass compromise, and it is the number worth carrying into your next patching conversation. The failure mode here was not an unknown flaw. It was a known flaw on an appliance nobody had a maintenance window for.

    QUIRSO counts 361 unique victim IP addresses across 47 countries. The top five: Germany (55), the United States (41), Turkey (38), Iran (26), France (25). None in mainland China.

    What the attackers leave behind

    From a single incident response engagement on one compromised appliance, QUIRSO documents a persistence chain with heavy redundancy:

    • reverse_ssh, an open-source SSH-based remote access tool, making outbound connections to attacker infrastructure for shell, file transfer, and network forwarding
    • A systemd service, sys-9436d8.service, continuously restarting a backdoor binary named linuxFile in /root/.local/share/cg4nQW9TOxeq/
    • Cron jobs masquerading as legitimate VMware tasks: vmware-vpxd-stats-*, vmware-perf-collect-*, vmware-perf-sync-*
    • A JSP webshell, vmware-perf-update.jsp, dropped into Perfcharts directories
    • Root SSH keys appended to authorized_keys, plus sudoers entries granting passwordless sudo
    • Rogue SSO administrator accounts: adminuser, vcadmin, svc_<ID>

    Six independent footholds, three of them named to blend into VMware’s own scheduled work. Applying the patch removes none of them.

    On attribution, QUIRSO assesses “with moderate confidence that the exploitation campaign targeting CVE-2026-59310 is operated by a Chinese-speaking threat actor,” citing Chinese-language artifacts, tooling, victimology, and UTC+8 activity patterns. They are explicit about the limits: “QUIRSO currently has insufficient evidence to associate the campaign with a named Chinese threat group or determine that it is directed by the Chinese state.” We are reporting that as they wrote it.

    Three things the coverage is getting wrong

    Broadcom has not confirmed exploitation. VMSA-2026-0006 contains no exploitation statement through revision .2, published 19 August — one day after the KEV listing. The word “exploit” appears only in the generic “a malicious actor may exploit this issue” phrasing that every advisory carries. Any sentence of the form “Broadcom warned that attackers are exploiting” or “VMware confirmed active exploitation” is wrong. The parties asserting exploitation are CISA and QUIRSO.

    This is not a zero-day. Several outlets have run it as one. By QUIRSO’s own timeline, exploitation began five days after the patch shipped. That is patch-gap exploitation, which is a different problem with a different fix — and frankly a more uncomfortable one, because it is entirely within your control.

    The ransomware claim has no source. At least one aggregator asserts Babuk-derived ransomware in connection with this CVE, attributing it to “social media reports.” QUIRSO’s own forensic report describes no ransomware whatsoever. We are not running it, and neither should anyone else without something to point at.

    What to do

    • Patch to the builds above. On 7.0, you need to contact Broadcom Support — there is no published build, and that guidance did not exist until three weeks after the advisory.
    • If your vCenter was network-reachable and unpatched at any point between 29 July and now, hunt before you assume you are fine. Look for unexpected systemd services, cron entries impersonating VMware tasks, JSP files in Perfcharts directories, additions to root’s authorized_keys, sudoers modifications, and SSO administrator accounts nobody created.
    • Rotate SSO credentials on any appliance you cannot rule out.
    • Do not treat patching as remediation. The documented persistence survives it, by design.

    Sourcing note

    The CVE description and CVSS come from Broadcom as CNA; NVD carries no independent primary score. KEV add and due dates were confirmed through NVD’s mirrored CISA fields and a second catalog mirror, as cisa.gov itself is not retrievable from here. Exploitation is asserted by CISA and by QUIRSO, not by Broadcom, whose advisory remains silent. The 361 figure counts unique victim IP addresses observed contacting attacker infrastructure — it is not 361 forensic investigations, and the detailed persistence chain above comes from a single IR case. Attribution is QUIRSO’s, at moderate confidence, with the firm itself stating it cannot tie the activity to a named group or to state direction. An earlier Rapid7 assessment finding no evidence of exploitation predates both the QUIRSO report and the KEV listing and should not be quoted as current. We could not verify the KEV catalog’s ransomware-use flag for this entry.