IT and AI security incidents, checked against the primary source

Tag: kev-due-2026-08-29

The vendor record understated the day, and a federal clock runs out tomorrow

The most consequential item on the site today is a Citrix flaw that Citrix still describes as a crash. CVE-2026-8452 is in CISA’s Known Exploited Vulnerabilities catalog with a federal remediation deadline of tomorrow, Saturday 29 August, and two research teams have taken it from an unauthenticated SAML request to a root shell. Citrix’s bulletin CTX696604 has not been updated since 20 July and still calls it a denial-of-service bug. Internet-facing, pre-authentication, a clock that expires in hours, and a vendor description that invites you to defer it — that combination outranks the two items that sound bigger. McKesson filed an 8-K this afternoon and Carhartt’s breach is being counted in the millions. Neither gives anyone anything to do tonight. The NetScaler appliance does.

The day had a real thread, and it is not a comfortable one: the vendor record kept failing to carry the risk. Citrix labels a root shell a denial of service. Broadcom’s vCenter advisory is at its third revision and still says nothing about exploitation, while a German DFIR firm has mapped 361 victim IP addresses across 47 countries. Microsoft published a CVSS 10.0 Entra ID flaw as exploited and then filed a one-line retraction that much of the coverage never followed. PaperCut’s emergency builds do not appear on PaperCut’s own release history. JFrog’s Artifactory flaw is on a federal clock that the July version most people patched to does not satisfy. And a CVSS 10.0 in ByteDance’s UI-TARS-desktop is remediated by a commit hash rather than a release. Six stories, one failure mode: anyone who triaged today from vendor severity text triaged it wrong.

Order of business after NetScaler. If you run N-central on premises, or you buy from an MSP that does, that is your first item instead — N-able says in its own words that attackers used Take Control to reach managed endpoints and left Cloudflare tunnels behind, and two rounds of patching were insufficient. Then vCenter, where the persistence chain outlives the patch. Then the rest of the weekend’s clocks: a 2019 SQL Server bug also due tomorrow, though it needs a privileged login to work, and an ownCloud authentication bypass from 2023 plus a Linux kernel container escape due Sunday. PaperCut is under active attack with no CVE at all, which means no KEV entry and no deadline to force it onto anyone’s list.

Below the clocks: three Langflow code-execution CVEs landed at NVD this evening with no workaround offered and 1.11.2 as the only fix. GPUThor is the day’s best research and the day’s most oversold coverage; it beat NVIDIA’s ECC on four workstation cards, not on the AI fleet. The GitLab exploitation claim rests on one firm’s honeypot data and GitLab has not addressed it; patch anyway, but do not carry the claim as confirmed. And two pieces on the record itself: BOD 22-01 has been dead since June, and this week’s KEV entries carry identical required-action text whether the deadline is three days or fourteen.

Still open. McKesson’s filing does not say whether data left the company; the statement it gave reporters the same day does, and the two have not been reconciled. Carhartt has said nothing publicly, and the 12.9 million figure is a researcher’s correction, not a company number. Broadcom’s vCenter advisory has been revised twice since the first victim callbacks and still does not mention exploitation. PaperCut still has no CVE. Two federal deadlines land Sunday, on a weekend, which is its own kind of answer about how the three-day band is working.

August 28, 2026
A 2019 SQL Server bug is on a federal clock that runs out Saturday, and it needs a login to work

CVE-2019-1068 was published in July 2019 and patched the same month; CISA added it to the Known Exploited Vulnerabilities catalog on 26 August 2026 with a 29 August due date, and it needs a privileged SQL login to work.

What happened

On 26 August 2026, CISA added CVE-2019-1068 to the Known Exploited Vulnerabilities catalog under the name “Microsoft SQL Server Remote Code Execution Vulnerability.” NVD’s republication of the entry gives a cisaExploitAdd of 2026-08-26 and a cisaActionDue of 2026-08-29. That is tomorrow, and it is a Saturday.

The vulnerability itself is seven years old. NVD shows it published 15 July 2019, the record last modified 27 August 2026. Microsoft’s description, carried in the CVE record: “A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka ‘Microsoft SQL Server Remote Code Execution Vulnerability’.” It carries a CVSS v3.1 base score of 8.8, vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

The PR:L in that vector is the whole character of the bug, and it is the part most likely to be lost in a headline. This is not an unauthenticated remote code execution flaw. It requires privileges — a low-privileged login on the SQL Server instance is enough, but something is required. An attacker who has one can get code execution in the context of the database engine.

Microsoft fixed it in the July 2019 security updates. KB4505217, which Microsoft’s own support article describes as the security update for SQL Server 2014 Service Pack 2 GDR released 9 July 2019, takes the affected components to build 12.0.5223.6 and supersedes KB4057120. It was one of a set of updates issued that month across the then-supported SQL Server branches.

CISA’s catalog entry gives no account of how the vulnerability is being exploited, by whom, or against what. Its required action is the same boilerplate string that appears on every entry in this week’s additions, including the ones on 14-day clocks. Microsoft’s Security Update Guide page for the CVE is a JavaScript application that returns nothing to automated retrieval, and the July 2019 CVRF bulletin lists the CVE without per-product detail. Secondary coverage reports that the catalog marks the vulnerability as not known to be used in ransomware campaigns; we could not read that field, because cisa.gov blocks automated fetching.

Why it matters

Start with what PR:L does to the threat model. A perimeter-facing, unauthenticated RCE in a database engine would be an emergency in the ordinary sense: anyone who can reach port 1433 owns the box. This is not that. To use CVE-2019-1068 an attacker needs a login. That places it firmly in the post-compromise half of an intrusion — the stage after credential theft, after a phished service account, after an application’s connection string turned up in a repository or a config file. It is a privilege and execution primitive for someone already inside, not a way in.

That is worth saying plainly because it changes who should care and how much. If your SQL Servers are unreachable from the internet, this does not become a non-issue; it becomes an issue about credential hygiene and lateral movement rather than about exposure. The realistic attack path is an attacker with a stolen application login using a seven-year-old bug to jump from “can query one database” to “can run code as the SQL Server service account.” What that account can reach next is the actual blast radius, and in a lot of environments the answer is uncomfortable, because SQL Server service accounts accumulate rights the way old file shares accumulate permissions.

The second thing worth noticing is which instances are still affected. A seven-year-old flaw fixed in a cumulative update is, by construction, absent from any SQL Server that has been taking updates. The population that remains vulnerable is not the well-maintained estate. It is the instances that stopped receiving updates for structural reasons: SQL Server Express bundled inside a third-party product, database engines embedded in appliances, application databases where the vendor pins a supported build and voids support if you patch past it. These are the instances that do not appear in the patch report because they do not appear in the inventory, and they are the ones where “just apply the update” runs into a support contract.

Third, look at the shape of this week’s additions. Of the six CVEs CISA added on 26 August, five predate 2023: two from 2015, this one from 2019, one from 2021, one from 2022. Only the Citrix NetScaler flaw is current. CISA is backfilling the catalog with old vulnerabilities for which it has newly acquired exploitation evidence, and a backfilled entry does not arrive as history. It arrives with a live federal deadline attached. An agency that closed its 2019 remediation tickets years ago is being asked to reopen the question in three days, against an asset population that has drifted for seven.

Finally, the clock. CVE-2019-1068 sits in the three-day band; the Citrix flaw added the same day shares its 29 August date; the ownCloud flaw added a day later is due 30 August. Meanwhile a CVSS 9.8 deserialization bug and a Linux kernel out-of-bounds write from the same 26 August batch got 14 days. Under BOD 26-04 that divergence is expected — deadlines derive from internet exposure, KEV listing, exploit automation, and whether technical impact is total or partial, not from severity. But the entry does not say which of those applied here, and the authoritative schedule is published only as images that public transcriptions disagree about. So an agency knows the date is Saturday and does not know, from the record, what else the date carries with it.

What to do

Inventory by build number, not by patch status. The question is not whether an instance is “patched.” It is which build it is on. Any SQL Server running a build that predates the July 2019 updates is in scope. For SQL Server 2014 SP2, KB4505217 takes the engine and Analysis Services to 12.0.5223.6; instances below that are unfixed. Query SELECT @@VERSION and SERVERPROPERTY('ProductVersion') across the estate rather than trusting a patch-management dashboard that may not enumerate SQL components separately.

Go looking for the instances nobody owns. Scan for SQL Server Express and embedded engines shipped inside other software — monitoring tools, backup products, line-of-business applications, appliance firmware. These are the ones most likely to be sitting on a 2019-era build, and they will not be in the database team’s inventory because the database team did not install them.

Treat the logins as part of the remediation. Because exploitation requires a login, credential hygiene is a real control here and not a consolation prize. Enumerate logins on affected instances, remove orphaned and shared accounts, revoke rights that applications no longer use, and check whether any application connects with elevated privileges it does not need.

Check what the service account can reach. A SQL Server engine running as LocalSystem or as a domain account with broad rights turns a database-scoped bug into a domain-scoped one. Where the engine runs with more than it needs, that is worth fixing regardless of this CVE’s deadline.

Where a vendor pins the build, isolate instead. If an ISV support agreement blocks the update, restrict network reachability to the instance and tighten authentication to it. The vector is AV:N, so reducing who can open a connection is a genuine mitigation, not a gesture. Document the decision — under BOD 26-04 the fallback for an unfixable asset is formal, and “the vendor would not let us” needs to be written down somewhere before Saturday, not after.

Sourcing note

KEV dates, the vulnerability name, the required-action text, the CVSS score and vector, the publication and last-modified dates and the description come from NVD’s API record for CVE-2019-1068, which republishes CISA’s catalog fields verbatim. cisa.gov returns 403 to automated fetching and blocked a direct request for the 26 August alert page, so the catalog page was not read and the catalog’s ransomware-use field could not be checked; the report that it is marked not known to be used in ransomware campaigns is secondary and is reported here as such.

Build and KB details for SQL Server 2014 SP2 come from Microsoft’s own support article for KB4505217. Microsoft’s Security Update Guide page for CVE-2019-1068 requires JavaScript and returned no vulnerability content to automated retrieval, and the July 2019 CVRF bulletin lists the CVE without per-product remediation detail, so a complete list of affected SQL Server versions and their fixed builds was not established from a Microsoft primary source. Tenable’s Nessus plugin 126631 for the July 2019 SQL Server updates enumerates ten KB articles — 4505217, 4505218, 4505219, 4505220, 4505221, 4505222, 4505224, 4505225, 4505419 and 4505422 — but that is a scanner vendor’s list, not Microsoft’s, and the mapping of each KB to a version and build was not verified here.

No public account of the exploitation exists that we could find. CISA cites no evidence in the entry, no vendor has published telemetry, and no named victim has been reported. The interpretation of PR:L and its consequences is analysis, not vendor statement. Deadline-band comparisons come from the NVD records for the other CVEs in the same additions. Unresolved: what exploitation CISA is acting on, and which SQL Server branches beyond 2014 SP2 remain affected at builds still in production.

August 28, 2026
Citrix calls CVE-2026-8452 a denial of service. Researchers used it to get root, and the federal deadline is Saturday

Citrix’s own advisory still describes CVE-2026-8452 as a denial-of-service bug. Two research teams have demonstrated it is a pre-authentication heap overflow that ends in a root shell, CISA added it to the Known Exploited Vulnerabilities catalog on 26 August, and federal civilian agencies have until Saturday 29 August to fix it.

What happened

Citrix published security bulletin CTX696604 on 30 June 2026, covering six vulnerabilities in NetScaler ADC and NetScaler Gateway: CVE-2026-8451, CVE-2026-8452, CVE-2026-8655, CVE-2026-10816, CVE-2026-10817 and CVE-2026-13474. The bulletin was updated twice — on 1 July to add a link to a Citrix blog post, and on 20 July to note disclosure coordination with the Okta Red Team. It has not been updated since.

Citrix describes CVE-2026-8452 in that bulletin as a “Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of Service,” classified as CWE-119, affecting appliances configured as a Gateway or AAA virtual server. Citrix scores it 8.8 under CVSS v4.0, vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:L/SI:L/SA:L. The affected builds are NetScaler ADC and Gateway 14.1 before 14.1-72.61, 13.1 before 13.1-63.18, NetScaler ADC FIPS before 14.1-72.61 FIPS, and NetScaler ADC FIPS/NDcPP before 13.1-37.272.

On 14 August, watchTowr Labs published research titled “You’re Back In The Room (Citrix NetScaler Pre-Auth RCE CVE-2026-8452(?))”. The question mark in that title is doing real work, and we will come back to it. What watchTowr described is a heap overflow in NetScaler’s SAML signature canonicalisation: the appliance copies attacker-controlled data from the PrefixList attribute inside a SAML message’s ds:SignedInfo element into a fixed-size global buffer “without checking whether it actually fits.” The overflow is linear, corrupts adjacent heap chunk metadata, and yields a write-what-where primitive through a corrupted data pointer. From there watchTowr overwrote a function pointer, tx_pkt_complete_fptr, to redirect execution into shellcode staged in an RWX heap region — the appliance enforces neither ASLR nor DEP on that memory. They disabled signal handlers to stop the appliance rebooting itself out of the exploit, set the SUID bit on /bin/sh for persistence, and dropped a PHP webshell. The result is remote code execution as root, with no credentials, against any appliance with SAML configured as either service provider or identity provider.

On 21 August, Bishop Fox published a non-destructive method for telling whether an appliance is actually patched. Sending a SAML request carrying a 575-byte PrefixList value to /saml/login (the IdP route) or /cgi/samlauth (the SP route) produces a 500 Internal Server Error 43549 on unpatched appliances and a 200 with the body “Malformed Assertion sent to Netscaler” on patched ones. Bishop Fox states that at 575 bytes they “have never seen a core dump, a daemon restart, or a reboot on any appliance we have tested,” and recommend a 35-byte control request to confirm the appliance is genuinely responding to length rather than answering identically regardless. Their checker is published at github.com/BishopFox/CVE-2026-8452-check.

CISA added CVE-2026-8452 to the KEV catalog on 26 August, in a batch of six, with a remediation deadline of 29 August. Four of the other five entries in that batch — a 2022 Linux kernel out-of-bounds write, two 2015 Red Hat flaws, and a 2021 AjaxPro deserialisation bug — were given 9 September. Only CVE-2026-8452 and a 2019 Microsoft SQL Server RCE were put on the three-day clock. That asymmetry inside a single batch is CISA signalling urgency, not a scheduling artefact.

Reporting on the KEV entry cites Shadowserver data showing more than 22,000 NetScaler ADC appliances and roughly 1,800 Gateway instances reachable from the internet, with patch status and SAML configuration unknown for essentially all of them. Exploitation was described publicly by several researchers before the KEV addition — Help Net Security reports webshells named x.php and z.php being dropped from infrastructure in three countries, in what observers characterised as untargeted spraying rather than selective intrusion.

Why it matters

There are three separate record problems stacked on this one CVE, and each of them changes how an organisation would have triaged it.

The first is the gap between the vendor’s impact statement and the demonstrated impact. “Denial of service” and “unauthenticated remote code execution as root on your edge authentication appliance” are not adjacent severities. They land in different queues. A team that read CTX696604 in early July and saw a DoS on a Gateway vserver would reasonably have scheduled the patch into a normal maintenance window, because a NetScaler that falls over is an outage, and outages get planned around. A team that read “pre-auth root” would have taken the appliance offline that evening. Citrix’s CVSS v4.0 vector is itself internally revealing here: it carries VC:H — high confidentiality impact — which is not what a pure denial-of-service condition produces. The score was arguably always describing something more than the prose was.

The second is that CISA’s KEV entry reproduces the vendor’s framing. The catalog’s short description for CVE-2026-8452 refers to an improper restriction of operations within the bounds of a memory buffer that “could lead to denial-of-service.” KEV is, for a large number of organisations, the authoritative severity signal — it is the list that gets ingested into vulnerability management platforms and turned into tickets. When the KEV entry inherits the vendor’s characterisation, the correction never reaches the people relying on the catalog rather than on security research blogs. An operator reading only the KEV row sees a denial-of-service bug with a three-day deadline and has no way to understand why the deadline is three days.

The third is the CVE mapping itself, and this is the one we are least able to resolve. watchTowr say plainly that they cannot confirm which CVE they analysed: “While we’d love to tell you we are definitely analyzing CVE-2026-8452, typical Citrix shenanigans (in our view) prevent us from doing so.” Their identification rests on matching the “memory overflow” description in the bulletin. Bishop Fox, working the same SAML code path, describe CVE-2026-8451 as a memory-disclosure bug in that same feature — also reachable without authentication, and in their characterisation already under active exploitation. CVE-2026-8451 is not on KEV. So the industry has settled on “CVE-2026-8452” as the label for a pre-auth RCE chain that the vendor has never described as remote code execution, in a SAML component that hosts at least two pre-auth bugs from the same bulletin, with the researchers who built the exploit stating they cannot confirm the mapping.

The practical consequence is that CVE-level remediation tracking is unreliable here. An organisation that patches “CVE-2026-8452” and an organisation that patches “the June NetScaler SAML bulletin” are doing the same thing, but only the second framing is robust to the mapping being wrong. This is a recurring failure mode with appliance vendors: the CVE becomes a poor key for the actual defect, and remediation programmes built on CVE identifiers inherit that imprecision.

There is also a pattern worth naming about the patch gap. The fix shipped 30 June. The public exploit chain landed 14 August. Opportunistic exploitation followed within days, and KEV followed on 26 August. That is roughly six weeks between an available patch and mass exploitation — a window that was entirely usable, and that many organisations spent believing they were looking at an availability bug. The lesson is not that everyone should patch everything immediately; it is that vendor impact prose is a weaker input than it looks, and that edge appliances terminating authentication deserve to be patched on the assumption that the worst plausible reading of the advisory is the correct one.

What to do

Upgrade NetScaler ADC and NetScaler Gateway to at least 14.1-72.61, 13.1-63.18, 14.1-72.61 FIPS, or 13.1-37.272 for FIPS/NDcPP builds, per CTX696604. Later builds on those branches are preferable — Citrix has shipped further releases since June, and going to current removes the question of which of the six bulletin CVEs you have actually addressed. Versions 12.1 and 13.0 are end of life and will not receive a fix; those appliances need replacing, not patching.

Treat SAML configuration as the exposure test, not as a reason to defer. If the appliance is configured as a Gateway or AAA virtual server with SAML in either service-provider or identity-provider role, it is in scope. If you are unsure, assume it is.

Verify rather than assume the patch applied. Bishop Fox’s length-based check distinguishes patched from unpatched appliances without crashing them, and is the fastest way to confirm a fleet is genuinely remediated rather than merely reported as remediated by an inventory system.

Patching does not evict an attacker who is already resident. Because the demonstrated exploit ends in root with persistence, treat any internet-facing appliance that was unpatched after 14 August as potentially compromised until inspected. Look for PHP files in web-served directories, specifically the reported x.php and z.php names but not only those; check whether /bin/sh carries a SUID bit; review the appliance’s /var/log for gaps, unexpected restarts, or nsppe crashes around mid-to-late August; and check for new or modified local accounts. Kill active sessions and rotate anything the appliance held — SAML signing certificates, LDAP or RADIUS bind credentials, session keys and admin passwords. A root-level compromise of an authentication gateway is a credential-store compromise.

Restrict management interface reachability while you are in there. CVE-2026-10816 in the same bulletin is an unauthenticated arbitrary file read requiring network access to the management interface; that interface should not be reachable from user networks or the internet regardless of patch level.

Federal civilian agencies: the remediation deadline is 29 August 2026.

Sourcing note

Confirmed by the vendor: the existence of CVE-2026-8452, its CVSS v4.0 score of 8.8, its classification as a memory overflow in Gateway and AAA virtual server configurations, the affected and fixed build numbers, and the bulletin’s publication and revision dates. All of this is from Citrix bulletin CTX696604 directly.

Confirmed by CISA: the KEV addition on 26 August 2026 and the 29 August 2026 remediation deadline for federal civilian executive branch agencies. Note that CISA’s own short description of the vulnerability repeats the denial-of-service characterisation. Reporting on the entry cites Binding Operational Directive 26-04 as the authority; other coverage of the following day’s KEV batch cites BOD 22-01. We could not retrieve the KEV catalog page directly during this run — cisa.gov returned 403 to our fetches — so the deadline date is taken from multiple independent sources reporting the same 29 August date, and the directive number is shown as disputed rather than resolved.

Not confirmed by the vendor: that CVE-2026-8452 permits remote code execution, and that it is being exploited. Citrix’s advisory contains no statement about exploitation in the wild and has not been revised since 20 July, five weeks before the KEV addition. The remote code execution finding is watchTowr Labs’ research, published 14 August, single-team and not corroborated by Citrix. watchTowr explicitly state they cannot confirm that the bug they analysed is CVE-2026-8452 rather than another CVE from the same bulletin; we have preserved that uncertainty rather than removing it.

Independent corroboration of the code path: Bishop Fox, publishing 21 August, describe the same SAML PrefixList handling and a length-boundary behaviour consistent with watchTowr’s account. Bishop Fox additionally characterise CVE-2026-8451 as under active exploitation; that is their assessment, and CVE-2026-8451 has not been added to KEV.

Claims, not confirmations: the webshell filenames, the three-country origin, and the “spray” characterisation come from researchers posting publicly and from reporting aggregating those posts, not from a vendor incident report or a named victim. The Shadowserver figures count appliances visible on the internet, not vulnerable or compromised appliances — no source has published a count of confirmed compromises, and we have not seen one.

Attribution: none. No source we reviewed attributes this activity to a named group, and we are not repeating any attribution that appears elsewhere.

August 28, 2026
vCenter servers are being backdoored five days after the patch, and Broadcom still hasn’t mentioned exploitation
CISA gave federal agencies three days to fix a vCenter directory traversal flaw. A German incident response firm has since mapped 361 victim IP addresses across 47 countries, with a persistence chain deep enough that patching does not remediate it. Broadcom’s advisory, now at its third revision, still says nothing about exploitation at all — and this is not the zero-day it is being called.

What happened

CVE-2026-59310 is a directory traversal vulnerability in the vCenter Syslog server leading to arbitrary code execution. Broadcom’s own description, as the CNA: “VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.” CWE-22, CVSS 9.8.

It arrived in VMSA-2026-0006, published 29 July 2026, now at revision .2. The advisory covers five CVEs across ESX, vCenter, Workstation, and Fusion. A companion flaw, CVE-2026-59309, is an authentication bypass in VMware Directory Service, also scored 9.8. There are no workarounds for any of them. Both vCenter flaws are credited to Phil Brass and Matt South of Atredis Partners.

Fixed versions for vCenter Server:
- 9.1.x → 9.1.0.0300
- 9.0.x → 9.0.2.0100
- 8.0 through U3j → 8.0 U3k, or express patch 8.0 U2f
- 7.0 → no build listed; the advisory says contact Broadcom Support. This guidance was added only at revision .2 on 19 August, three weeks after the original advisory.
Cloud Foundation, vSphere Foundation, Telco Cloud Infrastructure and Telco Cloud Platform are also in scope. Note that CVE-2026-59309 was first fixed in 9.1.0.0200, but 9.1.0.0300 is the current build.

CISA added CVE-2026-59310 to the Known Exploited Vulnerabilities catalog on 18 August, with a remediation deadline of 21 August — a three-day window, citing BOD 26-04 rather than the familiar BOD 22-01. CISA’s own enrichment record sets the exploitation status to Active, automatable, with total technical impact.

The patch gap is the story

QUIRSO, a German DFIR firm, published a campaign timeline that is the most useful thing written about this flaw. Advisory published 29 July. First signs of CVE-2026-59309 exploitation on 1 August. First victim callbacks for CVE-2026-59310 on 3 August — five days after the fix was available. Roughly 95% of the eventual victims were compromised by 5 August.

That is a one-week window between a public patch and mass compromise, and it is the number worth carrying into your next patching conversation. The failure mode here was not an unknown flaw. It was a known flaw on an appliance nobody had a maintenance window for.

QUIRSO counts 361 unique victim IP addresses across 47 countries. The top five: Germany (55), the United States (41), Turkey (38), Iran (26), France (25). None in mainland China.

What the attackers leave behind

From a single incident response engagement on one compromised appliance, QUIRSO documents a persistence chain with heavy redundancy:
- reverse_ssh, an open-source SSH-based remote access tool, making outbound connections to attacker infrastructure for shell, file transfer, and network forwarding
- A systemd service, sys-9436d8.service, continuously restarting a backdoor binary named linuxFile in /root/.local/share/cg4nQW9TOxeq/
- Cron jobs masquerading as legitimate VMware tasks: vmware-vpxd-stats-*, vmware-perf-collect-*, vmware-perf-sync-*
- A JSP webshell, vmware-perf-update.jsp, dropped into Perfcharts directories
- Root SSH keys appended to authorized_keys, plus sudoers entries granting passwordless sudo
- Rogue SSO administrator accounts: adminuser, vcadmin, svc_<ID>
Six independent footholds, three of them named to blend into VMware’s own scheduled work. Applying the patch removes none of them.

On attribution, QUIRSO assesses “with moderate confidence that the exploitation campaign targeting CVE-2026-59310 is operated by a Chinese-speaking threat actor,” citing Chinese-language artifacts, tooling, victimology, and UTC+8 activity patterns. They are explicit about the limits: “QUIRSO currently has insufficient evidence to associate the campaign with a named Chinese threat group or determine that it is directed by the Chinese state.” We are reporting that as they wrote it.

Three things the coverage is getting wrong

Broadcom has not confirmed exploitation. VMSA-2026-0006 contains no exploitation statement through revision .2, published 19 August — one day after the KEV listing. The word “exploit” appears only in the generic “a malicious actor may exploit this issue” phrasing that every advisory carries. Any sentence of the form “Broadcom warned that attackers are exploiting” or “VMware confirmed active exploitation” is wrong. The parties asserting exploitation are CISA and QUIRSO.

This is not a zero-day. Several outlets have run it as one. By QUIRSO’s own timeline, exploitation began five days after the patch shipped. That is patch-gap exploitation, which is a different problem with a different fix — and frankly a more uncomfortable one, because it is entirely within your control.

The ransomware claim has no source. At least one aggregator asserts Babuk-derived ransomware in connection with this CVE, attributing it to “social media reports.” QUIRSO’s own forensic report describes no ransomware whatsoever. We are not running it, and neither should anyone else without something to point at.

What to do
- Patch to the builds above. On 7.0, you need to contact Broadcom Support — there is no published build, and that guidance did not exist until three weeks after the advisory.
- If your vCenter was network-reachable and unpatched at any point between 29 July and now, hunt before you assume you are fine. Look for unexpected systemd services, cron entries impersonating VMware tasks, JSP files in Perfcharts directories, additions to root’s authorized_keys, sudoers modifications, and SSO administrator accounts nobody created.
- Rotate SSO credentials on any appliance you cannot rule out.
- Do not treat patching as remediation. The documented persistence survives it, by design.
Sourcing note

The CVE description and CVSS come from Broadcom as CNA; NVD carries no independent primary score. KEV add and due dates were confirmed through NVD’s mirrored CISA fields and a second catalog mirror, as cisa.gov itself is not retrievable from here. Exploitation is asserted by CISA and by QUIRSO, not by Broadcom, whose advisory remains silent. The 361 figure counts unique victim IP addresses observed contacting attacker infrastructure — it is not 361 forensic investigations, and the detailed persistence chain above comes from a single IR case. Attribution is QUIRSO’s, at moderate confidence, with the firm itself stating it cannot tie the activity to a named group or to state direction. An earlier Rapid7 assessment finding no evidence of exploitation predates both the QUIRSO report and the KEV listing and should not be quoted as current. We could not verify the KEV catalog’s ransomware-use flag for this entry.
August 28, 2026