Attackers exploit VMware vCenter Syslog directory traversal flaw for remote code execution

Summary

A critical vulnerability in the VMware vCenter Syslog server is currently being used in an active exploitation campaign. The flaw, tracked as CVE-2026-59310, allows an unauthenticated attacker with network access to execute arbitrary code on the system.

Digital forensics firm QUIRSO observed that compromised systems began connecting to attacker-controlled infrastructure on August 3, just five days after Broadcom disclosed the vulnerability and released emergency updates. The campaign has expanded rapidly, reaching 361 victim IP addresses across 47 countries by August 7. High concentrations of victims were identified in Germany, the United States, Turkey, Iran, and France.

Technical details

The vulnerability is a directory traversal flaw located within the vCenter Syslog server. Because it allows for arbitrary code execution, Broadcom assigned it a CVSS score of 9.8. An attacker can exploit this by gaining network access to the vCenter instance, which serves as a centralized management hub for virtual infrastructure, including ESXi servers and virtual machines.

Once initial access is achieved, researchers observed attackers deploying the open-source reverse_ssh framework. This tool establishes an outbound command-and-control (C2) channel, allowing the attacker to bypass traditional firewalls that typically restrict inbound connections.

While the specific identity of the threat actor remains unconfirmed, researchers believe an advanced persistent threat (APT) group is behind the activity. The rapid correlation between the vulnerability disclosure on July 29 and the start of the exploitation campaign suggests attackers acted quickly upon the public availability of the flaw.

Affected products and fixed versions

The vulnerability impacts VMware vCenter and several broader software stacks, including VMware Cloud Foundation, VMware vSphere Foundation, VMware Telcon Cloud Platform, and VMware Telco Cloud Infrastructure.

To remediate CVE-2026-59310, administrators must apply the following updates:

Broadcom notes that patches are cumulative; newer versions will include these fixes. Because the vulnerability involves the Syslog server, any product containing vCenter is considered affected.

Detection opportunities

Security teams can look for signs of the reverse_ssh framework to identify potential compromises. QUIRSO has released a generic YARA rule designed to detect reverse_ssh client binaries.

However, because this tool is also used in legitimate penetration testing, defenders should not rely on the YARA alert alone. A high-fidelity detection strategy involves monitoring for:

• Unauthorized installations of the reverse_ssh framework.
• Unexpected outbound network connections from vCenter systems to unknown external IP addresses.
• Unusual execution patterns within the Syslog server directory structure.

Defender guidance

Immediate action is required for any organization running web-accessible or network-accessible VMware vCenter instances.

1. Apply Emergency Patches: Prioritize updating vCenter to the versions listed in the official Broadcom advisory (VMSA-2026-0006).
2. Audit Network Access: Review firewall rules to ensure vCenter management interfaces are not unnecessarily exposed to the public internet or untrusted network segments.
3. Verify Outbound Traffic: Inspect network logs for unauthorized outbound SSH connections originating from your vCenter infrastructure, which may indicate an active reverse_ssh tunnel.
4. Validate Security Tools: If a YARA alert triggers for reverse_ssh, cross-reference the event with system change logs to distinguish between authorized testing and malicious activity.