Exploitation observed; activity peaked at 34 mentions and remains active
Recommended action window: Immediate (within 24h)
NVD description
VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.
Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-08-21. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Priority
CRITICAL
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
DECLINING
If you run products in this scope, you should treat this CVE as relevant to your environment.
3 versions affected across 5 products
| Date | Total | Labels |
|---|
| 2026-07-29 | 7 | Disclosure1General1Patch5 |
| 2026-07-30 | 15 | Disclosure6General2Patch7 |
| 2026-07-31 | 6 | Disclosure1General2Patch3 |
| 2026-08-04 | 1 | Patch1 |
| 2026-08-05 | 1 | Active Exploitation1 |
| 2026-08-08 | 1 | General1 |
| 2026-08-12 | 17 | Active Exploitation14Disclosure1General1Patch1 |
| 2026-08-13 | 19 | Active Exploitation16Disclosure1General1Patch1 |
| 2026-08-14 | 19 | Active Exploitation13Disclosure2Disclousure1General1Patch2 |
| 2026-08-15 | 8 | Active Exploitation8 |
| 2026-08-16 | 4 | Active Exploitation2Disclosure1General1 |
| 2026-08-17 | 34 | Active Exploitation31Disclosure1General1Patch1 |
| 2026-08-18 | 22 | Active Exploitation16Disclosure1Exploit2General1Patch2 |
| 2026-08-19 | 13 | Active Exploitation10Disclosure2General1 |
| 2026-08-20 | 11 | Active Exploitation9Disclosure1General1 |
| 2026-08-21 | 2 | Disclosure1General1 |
| 2026-08-22 | 2 | Active Exploitation2 |
| 2026-08-23 | 3 | Active Exploitation3 |
| 2026-08-24 | 4 | Active Exploitation4 |
| 2026-08-25 | 3 | Active Exploitation3 |
| 2026-08-26 | 4 | Active Exploitation2Patch2 |
| 2026-08-27 | 2 | Active Exploitation2 |
| 2026-08-28 | 2 | Active Exploitation2 |
| 2026-08-29 | 3 | Active Exploitation2Patch1 |
| 2026-08-31 | 3 | Active Exploitation3 |
| 2026-09-01 | 2 | Active Exploitation2 |
| 2026-09-02 | 1 | Active Exploitation1 |
| 2026-09-09 | 1 | Patch1 |
| 2026-09-10 | 1 | Active Exploitation1 |
| 2026-09-15 | 12 | Active Exploitation11Patch1 |
| 2026-09-16 | 15 | Active Exploitation14Patch1 |
| 2026-09-17 | 5 | Active Exploitation5 |
| 2026-09-18 | 4 | Active Exploitation3General1 |
| 2026-09-19 | 1 | Disclosure1 |
| 2026-09-20 | 1 | Active Exploitation1 |
| 2026-09-21 | 1 | Active Exploitation1 |
| 2026-09-22 | 9 | Active Exploitation2Disclosure6PoC1 |
| 2026-09-24 | 2 | Active Exploitation1Patch1 |
| 2026-09-26 | 1 | Active Exploitation1 |
| 2026-09-28 | 3 | Active Exploitation1Disclosure1PoC1 |
| 2026-09-29 | 1 | Disclosure1 |
| 2026-10-05 | 1 | Disclosure1 |
| 2026-10-07 | 1 | Disclosure1 |
| 2026-10-08 | 5 | Active Exploitation3Disclosure2 |
| 2026-10-11 | 1 | Active Exploitation1 |
| 2026-10-12 | 1 | Active Exploitation1 |
vCenter pre-auth RCE: CVE-2026-59309/59310 https://mobeta.fr/blog/vcenter-cve-2026-59309-cve-2026-59310/
Post summary
The tweet announces CVE-2026-59309/59310 affecting vCenter with pre-auth RCE, providing technical vulnerability details but no named exploit, patch, or active exploitation evidence, classifying it as a disclosure.
🚨 Four Critical Flaws Under Active Exploitation: • macOS CVE-2026-65400 • SharePoint CVE-2026-55040 • vCenter CVE-2026-59310 • Microsoft IKE CVE-2026-33824 Reported attacks include Monero mining, persistent access, and Babuk-derived ransomware. Read: https://thehackernews.com/2026/08/critical-macos-sharepoint-vcenter-and.html
Post summary
The post reports that four CVEs are actively exploited for cryptocurrency mining, persistence, and ransomware, with no patches or PoC details provided.
🚨 VMware vCenter exploitation leads to Babuk-derived #ransomware on ESXi. A suspected China-nexus actor exploited CVE-2026-59310 just five days after disclosure, compromising an estimated 361 IPs across 47 countries. Read: https://thehackernews.com/2026/08/suspected-china-nexus-actor-exploits.html
Post summary
CVE‑2026‑59310 has been actively exploited by a suspected China‑nexus actor, reportedly compromising more than 300 IP addresses worldwide.
⚡️ VMware just released a critical security update for ESXi hypervisor suite (VMSA-2026-0006). Two attack vectors: 1. Remote attack on vCenter – CVE-2026-59309: auth bypass via network access CVE-2026-59310: directory traversal RCE An exploit would allow control of entire ESXi infrastructure. 2. A VM-escapable set of two bugs – CVE-2026-59310: vmxnet3 OOBW CVE-2026-41703: core OOBR These are likely chainable to break out of VM and achieve code execution on hypervisor OS, as a privileged guest OS user. Diffing and exploiting (1) is straightforward and should be patched promptly.
Post summary
VMware announced a critical security update for ESXi, detailing several CVEs with severe exploitation potential and urging organizations to patch promptly.
🚨 Watch out: Attackers are exploiting VMware vCenter for persistence. After exploiting CVE-2026-59310, they planted a malicious cron job running reverse_ssh to maintain access. Researchers identified up to 361 victim IPs across 47 countries. Read more: https://thehackernews.com/2026/08/attackers-exploit-vmware-vcenter.html
Post summary
Attackers have actively exploited CVE-2026-59310 in VMware vCenter, deploying a reverse SSH cron job for persistence and affecting 361 IPs in 47 countries.
vCenter pre-auth RCE: CVE-2026-59309/59310 https://mobeta.fr/blog/vcenter-cve-2026-59309-cve-2026-59310/
Post summary
The tweet announces a critical pre-auth RCE vulnerability in vCenter, referencing CVE-2026-59309 and CVE-2026-59310, and links to a blog for technical details. It highlights the vulnerability type and CVEs without explicitly mentioning PoCs, exploits, or active exploitation.
🚨 CVE-2026-59310: VMware vCenter RCE A directory traversal flaw in the vCenter Syslog server can lead to arbitrary code execution. CVSS 9.8 | KEV | Public exploit Ransomware use: Known ExploitGrid: 95/100 Critical 🔎 https://exploitgrid.net/vulnerabilities/CVE-2026-59310
Post summary
The tweet highlights CVE-2026-59310, a directory traversal flaw in VMware vCenter Syslog server leading to RCE (CVSS 9.8), noting its inclusion in CISA KEV and known ransomware use, indicating active exploitation.
🚨 CISA: RANSOMWARE GANGS ARE NOW EXPLOITING CRITICAL VMWARE vCENTER RCE CISA has escalated its warning for CVE-2026-59310, confirming that the critical VMware vCenter vulnerability is now associated with known ransomware campaigns. CVE-2026-59310: * CVSS: 9.8 — CRITICAL * Product: VMware vCenter Server * Component: Syslog server * Weakness: Directory traversal * Attack vector: Network * Privileges required: NONE * User interaction: NONE * Arbitrary code execution possible * CISA KEV-listed * Ransomware campaign use: KNOWN Broadcom originally patched the vulnerability on July 29. But exploitation followed rapidly. Earlier incident-response research identified more than 361 compromised IP addresses across 47 countries after attackers began exploiting the vulnerability. Shadowserver is currently tracking more than 450 VMware vCenter servers exposed to the public internet. And now CISA has updated its KEV data to explicitly flag: “Known Ransomware Campaign Use: Known” 🚨 WHY vCENTER IS SUCH A HIGH-VALUE TARGET vCenter isn't just another server. It is the centralized management layer for VMware virtual infrastructure. Compromising it can potentially provide attackers with a privileged position over large portions of an organization's virtualized environment. The attack path can become: Internet-accessible vCenter → CVE-2026-59310 → Arbitrary code execution → vCenter compromise → Access to virtualization infrastructure → Credential theft / lateral movement → Ransomware ⚠️ IMPORTANT: CISA has confirmed ransomware campaign use, but has NOT publicly identified which ransomware groups are exploiting CVE-2026-59310 or disclosed details of those incidents. So attribution to any specific ransomware operation should currently be avoided unless independently supported. ⚠️ Analyst Note: The timeline is the warning. July 29: Broadcom releases patches. August: Active exploitation confirmed and CISA adds the vulnerability to KEV. September: CISA now flags the vulnerability as associated with ransomware campaigns. Organizations that haven't patched should assume attackers know about this vulnerability. Organizations that patched only after exploitation began should also consider historical compromise assessment rather than treating remediation as purely a patching exercise. Broadcom says there is NO workaround. Official CISA KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-59310 Official Broadcom advisory: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017 #DDW #VMware #Ransomware #CISA #CyberSecurity
Post summary
CISA confirms active exploitation of CVE-2026-59310 in ransomware campaigns, providing technical details, noting a patch was released (no workaround), and urging organizations to patch and assess prior compromise.
VMware vCenter Attackers Drop JSP Webshell Disguised as Performance Update Source: https://cybersecuritynews.com/vmware-syslog-path-traversal/ A fast-moving campaign is turning a VMware vCenter flaw into a route to full control of virtual infrastructure. Attackers are abusing CVE-2026-59310, a critical path traversal bug in the Syslog Server, to run commands as root without a normal login. A compromise in which the intrusion progressed from likely unauthenticated code execution to persistent access, account creation, ESXi control, and ransomware. The first observed victim connection occurred on August 3, five days after the vendor advisory. By August 5, 343 of the eventual 361 observed victim IPs had appeared. #cybersecuritynews
Post summary
Attackers exploited CVE‑2026‑59310 in VMware vCenter’s Syslog Server to gain root access, distributing a JSP webshell and affecting hundreds of IPs within days, evidencing active exploitation.
🚨 Critical VMware vCenter Vulnerabilities — CVSS 9.8 Broadcom has issued VMSA-2026-0006.1 addressing multiple vulnerabilities across VMware vCenter, ESX, Workstation, Fusion and Cloud Foundation. * CVE-2026-59309 — Critical vCenter authentication bypass, CVSS 9.8. * An attacker with network access to vCenter may bypass authentication and gain unauthorized access. * CVE-2026-59310 — Critical vCenter directory traversal vulnerability, CVSS 9.8. * An attacker with network access may exploit it to execute arbitrary code on vCenter. * CVE-2026-47876 — Critical VMXNET3 out-of-bounds write, CVSS 9.3, potentially allowing a malicious VM administrator to execute code on the ESXi host. * Broadcom also patched CVE-2026-41703 and CVE-2026-41709. * Broadcom lists NO workaround for the critical vulnerabilities. Organizations should prioritize applying the available patches. 🔎 Analyst Note: vCenter represents a high-value management plane. Compromise can provide attackers with extensive visibility and control over virtualized infrastructure, making authentication bypass and remote code execution vulnerabilities particularly serious for enterprise environments. Source: Broadcom https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017 #DDW #Cybersecurity #VMware #Vulnerability
Post summary
The announcement details multiple critical VMware vCenter CVEs, their severity, and the availability of patches while advising organizations to promptly apply them.
【警戒】中国との関連が疑われるAPTによるVMware vCenterのCVE-2026-59310（CVSS 9.8）が、公開からわずか5日ほどでグローバルに悪用 QUIRSOの調査では、日本を含む47か国・361の被害IPを確認。ドイツ、米国、トルコ、イラン、フランスを中心に、テクノロジー、ソフトウェア、サイバーセキュリティ、 大学・研究機関、通信などに被害が広がっています。 すでに侵入されていれば、パッチ適用後もcron、systemd、WebShell、SSH公開鍵、不正SSOアカウント、reverse_sshなどの永続化が残っている可能性があります。 インターネットからアクセス可能だったvCenterについては、Assume Breachの考え方で、パッチ適用と同時に侵害調査・資格情報ローテーション・C2通信確認まで実施すべき事案です。 攻撃者はCVE-2026-59310を悪用してvCenter上でroot権限のコード実行を行い、 CVE-2026-59310 ↓ root権限でRCE ↓ cronによる実行・永続化 ↓ VMwareサービスを装ったジョブ ↓ JSP WebShell ↓ SSO管理者アカウント作成 ↓ 資格情報窃取 ↓ reverse_sshでC2確立 ↓ ESXiへ展開 ↓ Babuk系ランサムウェア という攻撃チェーンが確認されています。 出典：QUIRSO GmbH「Global Exploitation of CVE-2026–59310 by Suspected Chinese-Nexus APT」(2026/8)
Post summary
The post reports that CVE‑2026‑59310 is actively exploited worldwide within five days of disclosure, outlining a confirmed RCE to root chain, and advises patching and comprehensive response actions.
Vulnerabilidad de VMware Syslog permite RCE root, acceso SSH y ransomware en ESXi Una campaña acelerada está aprovechando el fallo CVE-2026-59310 en el servidor Syslog de VMware vCenter https://blog.elhacker.net/2026/08/vulnerabilidad-de-vmware-syslog-permite.html
Post summary
CVE-2026-59310 is a VMware Syslog server vulnerability that is actively exploited to achieve root RCE and ransomware on ESXi, as reported in the linked blog post.
🚨 Chińskie grupy APT wykorzystują krytyczną lukę CVE-2026-59310 do masowych ataków na środowiska VMware vCenter 👾 Podatność umożliwia zdalne wykonanie kodu (RCE) z uprawnieniami roota. 🛠️ Zdaniem analityków z firmy QUIRSO cyberprzestępcy masowo atakują podatne urządzenia, aby przygotować grunt pod dalsze działania. ⚙️ Zaleca się natychmiastowe wdrożenie poprawek bezpieczeństwa udostępnionych przez producenta oraz sprawdzenie infrastruktury pod kątem wykrycia intruza. 👉 Szczegóły: https://sekurak.pl/chinskie-grupy-apt-wykorzystuja-podatnosc-cve-2026-59310-do-masowych-atakow-na-srodowiska-vmware-vcenter/
Post summary
Chinese APT groups are actively exploiting CVE‑2026‑59310 in VMware vCenter, enabling remote code execution with root privileges, and users are urged to apply vendor patches immediately.
🚨 VMware vCenter systems are being actively targeted — attackers are exploiting a critical flaw, CVE-2026-59310, to gain remote control. More Details: https://cybersecuritynews.com/vmware-vcenter-remote-access-exploited/ #cybersecuritynews https://t.co/kwM11u2P7h
Post summary
VMware vCenter is being actively exploited via CVE-2026-59310, with attackers reportedly gaining remote control; additional details are linked.
بخصوص ثغرات VMware + vCenter CVE-2026-59309 تتجاوز المصادقة في Directory Service وتمنح المهاجم وصولاً غير مصرح به. CVE-2026-59310 تستغل Directory Traversal في Syslog server لتشغيل كود. كلتاهما 9.8، ويكفي وصول المهاجم إلى vCenter عبر الشبكة. الثغرة الثالثة CVE-2026-47876 هي VM escape بدرجة 9.3 داخل VMXNET3.
Post summary
The post enumerates three VMware vCenter vulnerabilities with brief technical descriptions but provides no PoC, exploit code, patch, or evidence of active exploitation.
🚨 On 7/29/26, #Broadcom published a security advisory addressing multiple vulns in #VMWare products. Of particular interest are CVE-2026-59309 & CVE-2026-59310, 2 critical, remotely exploitable vulns affecting vCenter Server. More in the Rapid7 blog: https://r-7.co/4bl4Z96 https://t.co/vmQpz55F7V
Post summary
Broadcom announced a security advisory on 7/29/26 for two critical, remotely exploitable vulnerabilities (CVE‑2026‑59309 & CVE‑2026‑59310) in VMware vCenter Server, with further details linked to a Rapid7 blog post.
هشدار امنیتی : دسترسی سرور Vmware Esxi و VCenter رو سریعا محدود به آی پی های خودتون کنید. آسیبپذیری های بحرانی با شناسههای CVE-2026-59309، CVE-2026-59310 و CVE-2026-47876 شناسایی شدهاند. سرورها به طور گسترده در حال هک شدن و Encrypt شدن دیتا توسط باج افزار هستند.
Post summary
A security alert warns that VMware ESXi and vCenter are vulnerable to CVE‑2026‑59309, CVE‑2026‑59310, and CVE‑2026‑47876, with active exploitation occurring; users should immediately restrict access and apply mitigation measures.
A Chinese-speaking threat group exploited CVE-2026-59310 and CVE-2026-59309 to navigate vCenter, deploy Babuk-derived ransomware on ESXi, and establish persistent, credential-stealing access across 47 countries. https://thecybersecguru.com/news/vmware-vcenter-cve-2026-59310-babuk-esxi-ransomware/
Post summary
A Chinese-speaking threat group actively exploited CVE-2026-59310 and CVE-2026-59309 to deploy Babuk-derived ransomware on ESXi and establish credential‑stealing access across 47 countries.
🔴 VMware vCenter için alağıdaki güvenlik açıklarına yönelik public PoC'ler bu hafta yayınlandı. CVE-2026-59309: VMware Directory Service, authentication bypass · CVSS 9.8 CVE-2026-59310: vCenter Syslog receiver, directory traversal -> arbitrary code execution · CVSS 9.8 vCenter sistemleriniz için güvenlik güncellemelerini halen yapmadıysanız mutlaka yapın, ayrıca vCenter erişimini kısıtlayın / local erişilebilecek şekilde ayarlayın.
Post summary
Public PoCs for two high-severity VMware vCenter CVEs (authentication bypass and RCE via directory traversal) were published this week. The post urges applying security updates and restricting access, emphasizing the availability of proof-of-concept code.
Two pre-auth vulnerabilities in VMware vCenter: authentication bypass and RCE Read on dbugs: https://dbu.gs/news/two-pre-auth-vulnerabilities-in-vmware-vcenter-authentication-bypass-and-rce-20260924 Raphaël Dray of Mobeta analyzed CVE-2026-59309 (https://dbu.gs/vulnerability/CVE-2026-59309) and CVE-2026-59310 (https://dbu.gs/vulnerability/CVE-2026-59310) — two critical VMware vCenter vulnerabilities that can be exploited without prior authentication. CVE-2026-59309 (https://dbu.gs/vulnerability/CVE-2026-59309) — an authentication bypass in VMware Directory Service ("vmdird"). The flaw was in the Cyrus SASL "http://libsrp.so" library, which implements SRP (Secure Remote Password) for LDAP authentication. The server checked that the public value "A" was greater than zero but omitted the required "A mod N != 0" check. By sending "A = N", an attacker can obtain a predictable shared secret and generate a valid authentication proof without knowing the password. The researcher confirmed the attack by performing an SRP bind as "administrator@vsphere.local" without a password and gaining access to the vSphere SSO directory. Patch diffing showed that the fix added the missing modulo check in "srp_server_mech_step2". CVE-2026-59310 (https://dbu.gs/vulnerability/CVE-2026-59310) affects vCenter's Syslog infrastructure. Sender-controlled "HOSTNAME" and "APP-NAME" values were inserted into "rsyslog" output paths without protection against path traversal. A specially crafted Syslog message allows an attacker to escape "/var/log/vmware/" and write a file to an arbitrary location where "rsyslog" has write permission. The researcher demonstrated writing to the VAMI web root and confirmed RCE, but intentionally did not disclose the full code-execution chain. Exploitation requires network access to the Syslog listener — UDP/TCP 514 or TLS Syslog. "rsyslog" itself is not vulnerable: the issue was in VMware's configuration template, and the fix uses "secpath-replace" to sanitize attacker-controlled path components. Mobeta's analysis compares the vulnerable vCenter 8.0.3.00900 with the fixed 8.0.3.01000, in which both issues are patched. Article: https://mobeta.fr/blog/vcenter-cve-2026-59309-cve-2026-59310/ CVE-2026-59309 — PT-2026-65832: https://dbu.gs/vulnerability/PT-2026-65832 CVE-2026-59310 — PT-2026-65833: https://dbu.gs/vulnerability/PT-2026-65833
Post summary
The text discloses technical details of two critical VMware vCenter vulnerabilities (CVE-2026-59309, CVE-2026-59310) but primarily emphasizes available fixes and patched versions (8.0.3.01000), fitting the Patch classification.
31 of 31 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | vmware | cloud_foundation | - | - | - |
| App | vmware | telco_cloud_infrastructure | 3.0 | - | - |
| App | vmware | telco_cloud_platform | - | - | - |
| App | vmware | vcenter_server | - | - | - |
| App | vmware | vcenter_server | 8.0 | - | - |
| App | vmware | vcenter_server | 8.0 | - | - |
| App | vmware | vcenter_server | 8.0 | - | - |
| App | vmware | vcenter_server | 8.0 | - | - |
| App | vmware | vcenter_server | 8.0 | - | - |
| App | vmware | vcenter_server | 8.0 | - | - |
| App | vmware | vcenter_server | 8.0 | - | - |
| App | vmware | vcenter_server | 8.0 | - | - |
| App | vmware | vcenter_server | 8.0 | - | - |
| App | vmware | vcenter_server | 8.0 | - | - |
| App | vmware | vcenter_server | 8.0 | - | - |
| App | vmware | vcenter_server | 8.0 | - | - |
| App | vmware | vcenter_server | 8.0 | - | - |
| App | vmware | vcenter_server | 8.0 | - | - |
| App | vmware | vcenter_server | 8.0 | - | - |
| App | vmware | vcenter_server | 8.0 | - | - |
| App | vmware | vcenter_server | 8.0 | - | - |
| App | vmware | vcenter_server | 8.0 | - | - |
| App | vmware | vcenter_server | 8.0 | - | - |
| App | vmware | vcenter_server | 8.0 | - | - |
| App | vmware | vcenter_server | 8.0 | - | - |
| App | vmware | vcenter_server | 8.0 | - | - |
| App | vmware | vcenter_server | 8.0 | - | - |
| App | vmware | vcenter_server | 8.0 | - | - |
| App | vmware | vcenter_server | 8.0 | - | - |
| App | vmware | vcenter_server | 8.0 | - | - |
| App | vmware | vsphere_foundation | - | - | - |