Menace actors have begun to actively exploit a lately patched essential safety flaw in Broadcom VMware vCenter, in keeping with new findings from QUIRSO.
The vulnerability in query is CVE-2026-59310 (CVSS rating: 9.8), a directory-traversal vulnerability within the VMware vCenter server {that a} malicious actor with community entry can exploit to execute arbitrary code. Patches for the flaw have been launched by Broadcom late final month.
The German cybersecurity firm mentioned it found the exercise following an incident response engagement. The assault chain is alleged to have exhibited path traversal exercise in step with the flaw, adopted by the deployment of a malicious cron job to determine persistence on the host utilizing reverse_ssh, an open-source software used for organising SSH connections to menace actor-controlled infrastructure.
Compromised programs recognized by QUIRSO have been discovered to first set up contact with the attacker’s domains on August 3, 5 days after Broadcom publicly disclosed the failings. In all, there are as many as 361 distinctive sufferer IP addresses positioned throughout 47 international locations. Most of them are positioned in Germany, the U.S., Turkey, Iran, and France.
“Whereas the attacker may need had prior data of the vulnerability, the robust correlation between the time of disclosure and exploitation suggests the disclosure because the preliminary start line for the marketing campaign,” QUIRSO added.
It is not clear who’s behind the exploitation marketing campaign, but it surely’s believed to be the work of a suspected superior persistent menace (APT) actor.
It is value stating that VMware home equipment have been a profitable goal for Chinese language menace actors like UNC5174, who’ve weaponized safety flaws impacting VMware Instruments and VMware vCenter in numerous espionage campaigns.
In April 2025, SentinelOne disclosed particulars of a menace cluster dubbed PurpleHaze that focused a South Asian authorities supporting entity with a Home windows backdoor referred to as GoReShell, which makes use of functionalities from the reverse_ssh software to determine reverse SSH connections to attacker-controlled hosts.
Using reverse_ssh is notable because it permits the attacker to determine an outbound connection to an endpoint beneath their management, successfully bypassing safety controls designed to forestall suspicious inbound requests.
“The presence of reverse_ssh mustn’t, by itself, be handled as proof of malicious exercise,” QUIRSO famous. “Together with unauthorized set up, surprising outbound connections or execution on a weak vCenter equipment, nonetheless, it’s a high-priority indicator requiring investigation.”
The disclosure comes as Defused Cyber mentioned it is observing a spike in scanning towards VMware vCenter that’s indicative of potential exploitation efforts concentrating on CVE-2026-59309 (CVSS rating: 9.8).
“Our honeypots are logging elevated fingerprinting – equivalent to model probes through POST /sdk/ (RetrieveServiceContent) and walks of the /websso SAML SSO move – coinciding with Broadcom’s VMSA-2026-0006 (CVE-2026-59309, unauth auth-bypass in vmdir, CVSS 9.8),” the cybersecurity firm mentioned.
Denis Szadkowski, COO and co-founder of QUIRSO GmbH, instructed The Hacker Information that there’s not sufficient proof at this stage to correlate exploitation and scanning efforts utilizing CVE-2026-59309 with the intrusion set or the attacker infrastructure related to CVE-2026-59310.
“What we will say with a lot increased confidence is that the exercise we investigated represents a profitable compromise slightly than merely exploitation makes an attempt, and the forensic proof strongly factors towards CVE-2026-59310 because the preliminary entry vector,” Szadkowski added.
