Ransomware Gangs Exploit Critical VMware vCenter RCE Flaw (CVE-2026-59310)
In July 2026, Broadcom patched CVE-2026-59310, a critical directory traversal vulnerability in VMware vCenter's Syslog server that allows unauthenticated remote code execution. Despite urgent patching guidance, threat actors quickly began exploiting the flaw within weeks, with QUIRSO identifying over 361 compromised IP addresses across 47 countries. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities catalog in August and recently flagged it as actively exploited by ransomware gangs, highlighting the critical risk to enterprise virtualization infrastructure. This incident underscores the accelerating timeline between vulnerability disclosure and ransomware exploitation, particularly targeting VMware environments that serve as high-value infrastructure targets for enterprise data access and lateral movement capabilities.
Kill Chain
