Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access
Summary: QUIRSO reported active exploitation of CVE-2026-59310, a directory-traversal flaw in Broadcom VMware vCenter with a CVSS score of 9.8 that allows an actor with network access to execute arbitrary code, following patches released late last month. Compromised systems first contacted attacker domains on August 3, five days after public disclosure, and the campaign used a malicious cron job with the open-source reverse_ssh tool for persistence across as many as 361 unique victim IP addresses in 47 countries, most in Germany, the U.S., Turkey, Iran, and France.
What you should know: Attackers reached 361 victim IPs across 47 countries within five days of disclosure, and reverse_ssh's outbound connections bypass controls built to block inbound requests - so patch latency and egress monitoring are the two levers that decide whether you are in that count.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-59309CVE-2026-59310
- Related