Ransomware Gangs Exploit Critical VMware vCenter RCE CVE

Ransomware gangs have joined attacks exploiting a critical VMware vCenter remote code execution flaw. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) updated its Known Exploited Vulnerabilities catalog to flag CVE-2026-59310 as actively abused by ransomware operators. Organizations running unpatched vCenter servers face an elevated risk of full network compromise and encryption.

What Happened: CISA Confirms Ransomware Gangs Exploit VMware vCenter CVE-2026-59310

Broadcom patched CVE-2026-59310 on July 29, 2026. The flaw is a critical directory traversal vulnerability in the vCenter Syslog server. Unauthenticated attackers can exploit it to execute arbitrary code on affected systems. At the time of disclosure, Broadcom warned customers to treat the fix as an emergency.

Two weeks after the patch release, digital forensics firm QUIRSO reported over 361 compromised IP addresses across 47 countries. A suspected advanced persistent threat actor used the flaw to deploy reverse SSH tools for persistence. CISA added CVE-2026-59310 to its KEV catalog on August 18, 2026. The agency ordered federal agencies to patch within three days.

Over the weekend, CISA updated the KEV catalog again. This time the agency confirmed that ransomware gangs are actively exploiting the vulnerability. The shift from APT-style espionage to ransomware-driven encryption raises the stakes for every organization with an exposed vCenter instance.

Technical Details of the VMware vCenter Directory Traversal Vulnerability

CVE-2026-59310 stems from a directory traversal weakness in the vCenter Syslog server component. The flaw allows an unauthenticated remote attacker to bypass path restrictions and write arbitrary files. Successful exploitation leads to remote code execution with elevated privileges.

Attackers on an adjacent network can trigger the vulnerability without user interaction. The attack complexity is low. According to CISA, the flaw satisfies the conditions for remote, proximal exploitation. In practice, this means an attacker on the same network segment can compromise the vCenter server in minutes.

Once inside, attackers have deployed the following tools and tactics:

• Reverse SSH tunnels for persistent remote access
• Credential harvesting from vCenter databases
• Lateral movement to ESXi hosts and virtual machines
• Ransomware deployment across the virtual infrastructure

Internet threat monitor Shadowserver currently tracks over 450 VMware vCenter servers exposed online. It is not known how many remain unpatched. Each exposed instance represents a potential entry point for ransomware operators.

Business and Operational Impact

The addition of ransomware gangs to the exploit pool changes the risk calculus for every enterprise running VMware vCenter. The consequences of successful exploitation extend far beyond a single server.

• Full virtual infrastructure encryption: Compromised vCenter servers give attackers administrative control over ESXi hosts and guest VMs. Ransomware gangs can encrypt entire data centers in a single operation.
• Data exfiltration and extortion: Before encryption, attackers may steal sensitive virtual machine disks, backups, and configuration files. Double-extortion tactics are common among modern ransomware groups.
• Service disruption: Virtualized environments power email, databases, applications, and customer-facing services. Encryption can halt business operations for days or weeks.
• Compliance and regulatory exposure: A successful ransomware attack may trigger breach notification requirements under GDPR, HIPAA, and state privacy laws.
• Incident response costs: Forensics, recovery, legal counsel, and notification costs can reach millions of dollars for large organizations.

VMware infrastructure has been a favored target for ransomware groups for years. Dedicated Linux encryptors exist for ESXi environments. CVE-2026-59310 gives these groups a fresh, reliable entry point.

Mitigation and Recommendations

Organizations must act immediately to reduce exposure. CISA’s KEV inclusion carries binding operational directive requirements for federal agencies and strong guidance for the private sector.

Immediate Actions for Defenders

1. Apply Broadcom’s patch immediately. The fix was released on July 29, 2026. Delayed patching is the primary risk factor.
2. Verify vCenter version. Ensure all instances run a patched release. Check the Broadcom security advisory for specific version guidance.
3. Scan for indicators of compromise. Look for unauthorized SSH connections, unexpected user accounts, and anomalous network traffic from vCenter appliances.
4. Review access logs. Examine Syslog and vCenter Server logs for suspicious requests to the Syslog service endpoint.
5. Segment vCenter networks. Restrict vCenter management interfaces to dedicated, firewalled networks. Limit exposure to the internet.

Long-Term Hardening Steps

• Enable multifactor authentication for all vCenter administrative accounts.
• Implement network segmentation between vCenter, ESXi hosts, and production workloads.
• Deploy endpoint detection and response tools on vCenter appliances where supported.
• Maintain offline, immutable backups of critical virtual machines and configurations.
• Subscribe to CISA KEV updates and vendor security bulletins for timely patch notifications.

Bottom line: CVE-2026-59310 is no longer just an APT threat. Ransomware gangs are actively exploiting it. If your vCenter server is unpatched, assume it is a target. Patch now, scan for compromise, and segment your virtual infrastructure before attackers beat you to it.

Incident Summary

CVE ID / Incident:	CVE-2026-59310
Affected Systems:	VMware vCenter Server (versions patched July 29, 2026)
Disclosure Date:	July 29, 2026 (ransomware exploitation confirmed September 2026)
Patch Status:	Patch available; apply immediately
Attack Vector:	Network-adjacent, unauthenticated remote code execution
CISA KEV Due Date:	Three-day patching mandate for federal agencies
Exposed Instances:	450+ vCenter servers tracked online by Shadowserver

References

1. Broadcom, “VMware Security Advisory VMSA-2026-0006,” July 29, 2026, https://support.broadcom.com/security-advisory, accessed September 16, 2026.
2. CISA, “CISA Adds Four Known Exploited Vulnerabilities to Catalog,” August 18, 2026, https://www.cisa.gov/news-events/alerts/2026/08/18/cisa-adds-four-known-exploited-vulnerabilities-catalog, accessed September 16, 2026.
3. CISA, “Known Exploited Vulnerabilities Catalog: CVE-2026-59310,” updated September 2026, https://www.cisa.gov/known-exploited-vulnerabilities-catalog, accessed September 16, 2026.
4. BleepingComputer, “CISA: Critical VMware RCE flaw now exploited by ransomware gangs,” September 15, 2026, https://www.bleepingcomputer.com/news/security/cisa-critical-vmware-vcenter-rce-flaw-now-exploited-by-ransomware-gangs/, accessed September 16, 2026.
5. Shadowserver Foundation, “VMware vCenter Exposure Statistics,” https://dashboard.shadowserver.org/statistics/iot-devices/time-series/, accessed September 16, 2026.