A 9.8-severity bug in vCenter's syslog server went from patch to active exploitation in five days, and attackers are planting permanent backdoors, not just stealing data.
Broadcom patched a critical hole in VMware vCenter on July 29, 2026. Five days later, attackers were already inside — and by August 5, they'd hit 361 servers across 47 countries. This isn't a smash-and-grab. They're planting a cron job that phones home over SSH every time the box reboots, which means patching the hole doesn't automatically kick them out if they got there first.
The bug: a directory traversal in a service you probably forgot existed
The vCenter Syslog server isn't the part of vCenter anyone thinks about day to day — it quietly ingests log data from across a virtualized environment. That's exactly what makes it a good target. Broadcom's advisory describes CVE-2026-59310 as a directory traversal vulnerability that lets an unauthenticated attacker with network access write files outside the intended directory and, from there, execute arbitrary code. No login required, no phishing, just a crafted request against a service most admins never touch directly.
Which vCenter build fixes it
vCenter 9.1
Branch
9.1.0.0300
vCenter 9.0
Branch
9.0.2.0100
vCenter 8.0 (U3 branch)
Branch
8.0 U3k
vCenter 8.0 (U2 branch)
Branch
8.0 U2f
Branch
Fixed version
vCenter 9.1
9.1.0.0300
vCenter 9.0
9.0.2.0100
vCenter 8.0 (U3 branch)
8.0 U3k
vCenter 8.0 (U2 branch)
8.0 U2f
How fast attackers moved
Jul 29, 2026
Broadcom publishes VMSA-2026-0006, patching CVE-2026-59310 (CVSS 9.8) with no workaround offered.
Aug 3, 2026
First victim IPs start connecting to attacker infrastructure — five days after the patch shipped, meaning unpatched servers were already being probed at scale.
Aug 4, 2026
151 additional victim IPs appear in a single day as the campaign accelerates.
Aug 5, 2026
343 of the eventual 361 victim IPs — about 95% of the total — have now been observed, spread across 47 countries.
The attack chain researchers documented is short: path-traversal activity consistent with CVE-2026-59310, then a malicious cron job dropped onto the host, then a connection out to attacker infrastructure using reverse_ssh — an open-source tool built specifically to punch an SSH tunnel back to a remote controller. That's the tell that separates this from a smash-and-grab data theft. A cron job means the attacker wants to come back.
Confirm your vCenter build against the patched numbers above — check Administration > System Configuration or the appliance version in the vSphere Client.
Patch immediately to 9.1.0.0300, 9.0.2.0100, 8.0 U3k, or 8.0 U2f. Broadcom has published no workaround; patching is the only fix.
3
Hunt for unexpected cron jobs on the vCenter Server Appliance, especially ones invoking unfamiliar binaries.
4
Check outbound connections from vCenter for unusual SSH traffic to unrecognized IPs — that's the reverse_ssh callback QUIRSO documented.
If vCenter was internet-reachable and unpatched between July 29 and whenever you updated, treat it as potentially compromised and audit, don't just trust the patch.
Quick answers
Is CVE-2026-59310 exploitable without authentication?
Yes. Broadcom's advisory (VMSA-2026-0006) describes it as exploitable by an unauthenticated attacker with network access to the vCenter Syslog service, which is why it carries the maximum-tier 9.8 CVSS score.
Is there a workaround if I can't patch immediately?
No. Broadcom has not published a mitigation — patching to a fixed build is the only remediation path listed in the advisory.
How do I know if I've already been compromised?
Check for unrecognized cron jobs on the vCenter Server Appliance and look for outbound SSH connections to IPs you don't control — that's the signature of the reverse_ssh persistence tool researchers observed in this campaign.
Does patching remove an existing backdoor?
No — patching closes the entry point but doesn't remove a cron job or SSH key an attacker already planted. If your instance was internet-facing and unpatched during the exploitation window, treat it as potentially compromised, not just protected.
This is the same pattern behind SonicWall's SMA 1000 appliances a few weeks earlier — a critical edge appliance, a public patch, and an attacker moving before most admins even open the advisory email. It's also worth comparing against the Langflow RCE bug, where the same unauthenticated-to-shell path showed up in a completely different product category.
vCenter manages virtualization across the kind of infrastructure most of these 361 victims run. · UnsplashThe reverse_ssh tool used in this campaign gives attackers a persistent SSH tunnel back into compromised vCenter servers. · Unsplash
Verdict
Bottom line
If you run vCenter and haven't patched since July 29, do it today — then go hunting for cron jobs before you trust the patch alone.
Best for: Any org running on-prem VMware vCenter, especially with internet-facing management interfaces.
Broadcom hasn't said whether the attackers are a known ransomware crew or an access broker selling footholds onward — QUIRSO's write-up stops at the SSH backdoor, not attribution. Either way, a reverse SSH tunnel sitting quietly in a cron job is exactly the kind of foothold that turns into a ransomware note weeks later. Patch first, hunt second, and don't assume a clean scan means a clean box.
