Enterprise datacenter administrators and virtualization platform engineers are facing urgent security alerts following active, in-the-wild exploitation of a maximum-severity vulnerability in Broadcom VMware vCenter Server. Disclosed by incident response firm QUIRSO and cybersecurity researchers in mid-August 2026, threat actors are leveraging the flaw to establish persistent reverse SSH backdoors across compromised enterprise virtualization clusters.

Deconstructing the vCenter Syslog Server Directory Traversal (CVE-2026-59310)

Tracked as CVE-2026-59310 with a near-maximum CVSS severity rating of 9.8/10.0, the vulnerability resides in the VMware vCenter Syslog Server service daemon.

The flaw is caused by insufficient path sanitization, allowing an unauthenticated remote attacker with network access to the vCenter management interface to execute arbitrary code with elevated root privileges. Security telemetry revealed that attackers began active exploitation within five days of initial disclosure, infecting over 360 internet-exposed vCenter instances across 47 countries.

Once initial execution is achieved, attackers deploy automated reverse SSH tools that tunnel outbound through corporate firewalls, establishing resilient, encrypted persistence that survives standard appliance reboots.

Recommended Mitigation and Containment Actions

Because vCenter Server acts as the centralized control plane for enterprise ESXi hypervisors and virtual machines, a compromise grants adversaries full visibility and control over core enterprise workloads. Security operations teams should execute immediate containment procedures:

• Apply Vendor Security Updates: Immediately upgrade all VMware vCenter Server 7.0 and 8.0 deployments to the latest patched builds referenced in Broadcom Advisory VMSA-2026-0006.
• Eliminate Direct Internet Exposure: Ensure vCenter management interfaces are isolated from the public Internet and accessible solely via secure VPN or Zero Trust Network Access (ZTNA) gateways.
• Audit Appliance SSH Connections and Processes: Inspect active TCP connections on vCenter appliances for unexpected outbound SSH connections and review authorized SSH keys in /root/.ssh/authorized_keys for unrecognized entries.

Source: The Hacker News / Broadcom Security Advisory