A recent campaign has rapidly transformed a vulnerability in VMware vCenter into a mechanism for complete control over virtual systems. Attackers are exploiting CVE-2026-59310, a significant path traversal vulnerability in the Syslog Server, allowing command execution with root privileges without requiring standard login procedures.
Rapid Exploitation of vCenter Vulnerability
The exploitation of this flaw has escalated quickly from its initial disclosure to widespread use. QUIRSO has identified 361 compromised IP addresses across 47 nations, with sectors such as technology, academia, and telecommunications being most affected.
This situation underscores why vCenter management systems are enticing targets for cybercriminals. According to a report shared with Cyber Security News by QUIRSO GmbH, the breach evolved from unauthorized code execution to sustained access, account creation, and control over ESXi systems, ultimately deploying ransomware.
Syslog Vulnerability Enables Root Execution
The breach initiates when attackers leverage malformed cron files within /etc/cron.d, linked to the CVE and Syslog service. These files execute commands as root, confirming the use of the Syslog path traversal for unauthorized content deployment.
This exploit transforms a management device into an attack launchpad. The attackers utilize scheduled tasks to download tools, execute shell commands, and stage files in temporary folders. This root access also facilitates a web shell and administrator privileges without passwords via a legitimate service account.
Ransomware and Persistent Threats
Following initial entry, attackers established multiple persistence mechanisms. They used system services to restart backdoors and created deceptive tasks with VMware-like names to enable SSH and add an attacker’s key to root’s authorized keys.
The attackers further created local administrator accounts on ESXi hosts and transferred ransomware executables. A helper script halted virtual machines, initiated encryption on VMFS volumes, and disabled the VMware high-availability agent, leading to significant system unavailability.
The ransomware, derived from Babuk, partially encrypts large VMDK files, rendering virtual machines unusable. The presence of this ransomware family does not conclusively attribute the attack to a specific group, emphasizing the need for vigilance against similar ESXi ransomware incidents.
Mitigation and Future Outlook
Immediate application of relevant vCenter patches is crucial, as no workarounds suffice. Moreover, removing direct internet access to management interfaces and restricting administration to trusted networks are recommended. Reviewing new accounts, sudo changes, and directories for suspicious activity is vital.
Organizations should employ YARA to detect unauthorized remote-access tools and monitor unexpected outbound connections. Any signs of compromise should prompt a thorough incident response, including log preservation and credential rotation.
