Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access

Stylized cartoon illustration of vCenter under attack with outbound SSH tunnel and cron job

A newly disclosed critical flaw in VMware vCenter (CVE-2026-59310) has moved quickly from patch release to active exploitation, according to investigative reporting and telemetry from security firms. The vulnerability—a directory traversal bug that allows an actor with network access to execute arbitrary code—was patched by Broadcom late last month, and forensic evidence collected by QUIRSO indicates attackers were able to chain that weakness into persistent remote access on production appliances within days of disclosure.

Scope of the campaign

QUIRSO’s incident response work identified as many as 361 unique victim IP addresses spanning 47 countries, with concentrated impact in Germany, the United States, Turkey, Iran, and France. Compromised hosts began contacting attacker-controlled domains on August 3, roughly five days after Broadcom’s public advisory, which strongly suggests the disclosure acted as the immediate catalyst for this wave of intrusions. While attribution remains uncertain, QUIRSO and others characterize the activity as likely the work of a sophisticated actor—possibly an APT—given the speed, scale, and the nature of the post-exploitation tooling observed.

How the attackers operated

The observed attack chain begins with path traversal activity consistent with CVE-2026-59310 exploitation. Once initial access was achieved, attackers deployed a malicious cron job to establish persistence using reverse_ssh, a publicly available tool that creates outbound SSH connections to attacker-controlled systems. Because reverse SSH creates outbound sessions, it can bypass controls designed to block suspicious inbound connections and makes detection on the victim’s network more challenging unless outbound telemetry is closely monitored.

Why reverse_ssh matters (and what it isn’t)

Reverse_ssh is notable for its utility in creating reliable, outbound tunnels to gateways under the attacker’s control. However, defenders should not treat the mere presence of reverse_ssh as definitive proof of compromise. QUIRSO emphasizes that reverse_ssh becomes a high-priority indicator when it appears in combination with other suspicious signs—unauthorized installations, unexpected outbound connections, newly scheduled cron jobs on vCenter appliances, or execution activity tied to vulnerable versions of vCenter.

Related scanning and CVE-2026-59309

Separately, Defused Cyber reported a spike in scanning activity against VMware vCenter that appears to target CVE-2026-59309 (VMSA-2026-0006), an unauthenticated auth-bypass in vmdir also scored 9.8. Their honeypots logged increased fingerprinting—version probes and /websso SAML flow walks—coinciding with the public advisory. At the time of reporting, there was insufficient evidence to correlate the CVE-59309 scanning to the intrusion set exploiting CVE-59310, but the simultaneous focus on multiple vCenter flaws highlights how quickly attackers will probe exposed appliances once advisories are published.

Historical context: VMware appliances as a lucrative target

VMware’s management and tooling have been attractive targets for espionage and intrusion groups for years. Security teams should recall prior campaigns—such as those attributed to UNC5174—that weaponized VMware component flaws for broader espionage objectives. The tools and techniques observed in this campaign echo past incidents where reverse-SSH-style mechanisms and backdoors were used to maintain stealthy, persistent access.

Practical detection and response steps

– Patch immediately: Prioritize Broadcom’s vCenter updates addressing CVE-2026-59310 and CVE-2026-59309 across all management appliances and appliances exposed to untrusted networks.

Patch immediately: Prioritize Broadcom’s vCenter updates addressing CVE-2026-59310 and CVE-2026-59309 across all management appliances and appliances exposed to untrusted networks.
Check scheduled tasks: Search for unexpected cron jobs or scheduled tasks on vCenter appliances; malicious persistence was implemented as a cron entry in the observed intrusions.
Monitor outbound connections: Inspect egress traffic for connections to suspicious domains or IPs, especially SSH tunnels initiated from management appliances.
Audit file system and binaries: Look for unauthorized additions, changes to system binaries, or new SSH keys and agents.
Use telemetry to hunt: Correlate logs for path traversal attempts, POST /sdk/ probes, and SAML flow fingerprinting that may indicate reconnaissance or exploitation attempts.
Isolate and investigate: If compromise is suspected, isolate the appliance, collect forensic evidence (memory, disk, network logs), and engage incident response to determine scope and remediation steps.

Operational recommendations for defenders

– Limit network exposure: Ensure vCenter and related management interfaces are not directly reachable from the public internet unless protected by robust controls (VPN, strong firewall policies, zero-trust access).

Limit network exposure: Ensure vCenter and related management interfaces are not directly reachable from the public internet unless protected by robust controls (VPN, strong firewall policies, zero-trust access).
Harden administrative access: Enforce multifactor authentication, restrict admin privileges, and segment management networks.
Maintain baselines: Establish known-good baselines for scheduled tasks, file system contents, and running processes to speed detection of anomalies.
Plan for recovery: Keep tested backups and restoration procedures for critical infrastructure components, and rehearse incident response for management-plane compromises.

Conclusion

The rapid exploitation of CVE-2026-59310 underscores a predictable but persistent reality: high-severity advisories for widely used management appliances prompt immediate and targeted activity from adversaries. Organizations running VMware vCenter must treat these patches as urgent, hunt for indicators associated with reverse_ssh and unauthorized cron jobs, and assume that any exposed or unpatched appliance is a potential gateway to broader compromise.