Cybersecurity experts have identified active exploitation of a critical vulnerability in Broadcom’s VMware vCenter, posing significant risks to affected systems. The flaw, tracked as CVE-2026-59310, allows attackers with network access to execute arbitrary code, with a CVSS score of 9.8 highlighting its severity.
Exploitation Details and Attack Methodology
The German cybersecurity firm QUIRSO discovered evidence of exploitation during an incident response, revealing that attackers are utilizing a path traversal technique to deploy malicious cron jobs. These jobs harness the reverse_ssh tool to maintain a foothold on compromised systems. This tool facilitates SSH connections to infrastructure controlled by threat actors, enabling persistent access.
QUIRSO’s analysis indicates that compromised systems began communicating with attackers’ domains soon after Broadcom’s public disclosure of the flaw. The breach has affected 361 unique IP addresses across 47 countries, with Germany, the U.S., Turkey, Iran, and France being the most impacted.
Potential Attribution and Historical Context
While the identity of the attackers remains unknown, speculation points to an advanced persistent threat (APT) group. Historically, VMware appliances have been attractive targets for Chinese threat actors like UNC5174, who have conducted espionage by exploiting vulnerabilities in VMware products.
In a related instance, SentinelOne previously uncovered a threat cluster called PurpleHaze, which targeted South Asian entities using a backdoor named GoReShell. This backdoor also employed reverse_ssh to establish connections to attacker-controlled hosts, underscoring the persistent interest in VMware vulnerabilities by various threat actors.
Ongoing Investigations and Security Implications
The cybersecurity community is on high alert following reports from Defused Cyber of increased scanning activity targeting VMware vCenter. This activity suggests potential exploitation of both CVE-2026-59310 and another related flaw, CVE-2026-59309.
Denis Szadkowski, COO of QUIRSO, emphasized that current evidence more strongly supports CVE-2026-59310 as the vector for successful intrusions, rather than mere exploitation attempts. The presence of reverse_ssh, while not necessarily indicative of malevolent intent, becomes a critical concern when paired with unauthorized installations or unexpected outbound connections.
As cybersecurity professionals continue their investigations, organizations using VMware vCenter are urged to apply patches promptly and monitor for signs of compromise. The situation serves as a reminder of the importance of timely updates and vigilance in the face of evolving cybersecurity threats.
