Active Exploitation of Critical VMware vCenter Vulnerability (CVE-2026-59310) Escalates to Ransomware Deployment on ESXi
September 04th, 2026
Critical
Our Cyber Threat Intelligence Unit has identified an active exploitation campaign targeting CVE-2026-59310, a critical directory traversal vulnerability in the VMware vCenter Syslog server that allows an unauthenticated attacker with network access to execute arbitrary code. Third-party incident response firm QUIRSO reports that exploitation began on August 3, 2026, five days after Broadcom's July 29, 2026 patch, and has affected 361 IP addresses across 47 countries, with the largest concentrations in Germany, the United States, Turkey, Iran, and France. Following initial code execution, threat actors establish persistence through malicious cron jobs, deploy a JSP web shell and the open-source reverse_ssh tunneling tool for outbound command-and-control, harvest VMware Directory Service (vmdir) credentials, and create rogue SSO administrative accounts to take full control of the vCenter management plane. In at least one investigated case, this access was used to deploy Babuk-derived ransomware against ESXi hosts, encrypting VMFS datastores. QUIRSO assesses with moderate confidence that the campaign is linked to a Chinese-speaking threat actor, though it has not attributed the activity to a named APT group or nation-state. Affected systems include VMware vCenter deployments that have not applied the emergency patches in Broadcom's VMSA-2026-0006.2. CVE-2026-59310 was added to CISA's Known Exploited Vulnerabilities catalog on August 18, 2026.
Technical Details
Vulnerability Type: Directory traversal (CWE-22) in the vCenter Syslog server, leading to remote code execution.
Severity: Critical
CVE ID: CVE-2026-59310.
CVSSv3.1 Base Score: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
KEV Status: Added to CISA's Known Exploited Vulnerabilities catalog, August 18, 2026.
Authentication Required: None; exploitable by an unauthenticated attacker with network access to vCenter.
Threat Actors: Linked to a suspected Chinese-speaking threat actor (moderate confidence, per QUIRSO), based on Chinese-language artifacts in attacker scripts, reused Chinese-language security research, Chinese-language tooling, victimology excluding mainland China, and activity patterns consistent with UTC+08:00 working hours. Not attributed to a named APT group or nation-state.
Affected Products/Versions:
VMware vCenter: 9.1.x.x (prior to 9.1.0.0300), 9.0.x.x (prior to 9.0.2.0100), 8.0 (prior to U3k/U2f depending on branch), and 7.0.
VMware Cloud Foundation and vSphere Foundation (embedded vCenter, same version ranges).
VMware Telco Cloud Platform: 3.0, 4.x, 5.0.x, 5.1.x.
VMware Telco Cloud Infrastructure: 3.0.
Attack Chain:
Initial Access: Attacker sends crafted requests over the network to the vCenter Syslog server.
Exploitation: Directory traversal is leveraged to write outside the intended directory and execute arbitrary code as root on the vCenter appliance, without an associated authentication event.
Persistence: Cron jobs disguised with names resembling legitimate VMware services(e.g., "vmware-perf-collect-*", "vmware-perf-sync-") relaunch payloads at recurring intervals and survive reboots.
Web Shell Deployment: A cron job drops a JSP web shell ("vmware-perf-update.jsp") into the appliance's web server directory, providing an interactive command interface over standard HTTPS.
Credential Access: The payload harvests VMware Directory Service (vmdir) machine credentials, with a fallback method querying VMware's vmafd module directly, to authenticate to the local SSO domain.
Privilege Escalation: Harvested credentials are used to create a rogue administrative account and add it to the vSphere SSO Administrators group, giving the attacker full control of the vCenter management plane.
Channel: The open-source reverse_ssh tool establishes an outbound SSH connection to attacker-controlled infrastructure, bypassing network controls that typically block inbound connections.
Discovery: REST API calls using anomalous User-Agent strings ("GoodMoodle-VCFleet/1.0", "GoodMoodle-VCProbe/1.0") enumerate vSphere inventory — datacenters, clusters, hosts, VMs, datastores, and networks.
Ransomware Deployment: In at least one documented case, the actor used SSO-level access to reach ESXi hosts and deployed a Babuk-derived ransomware encryptor, disguised as "backup," against VMFS volumes.
Companion Vulnerability:
CVE-2026-59309, an authentication bypass in the VMware Directory Service (also CVSS 9.8), was disclosed and patched in the same advisory.
QUIRSO has stated there is not currently enough evidence to correlate CVE-2026-59309 exploitation/scanning activity with the intrusion set behind CVE-2026-59310.
Patch Status:
Broadcom released fixed versions (vCenter 9.1.0.0300, 9.0.2.0100, 8.0 U3k or U2f depending on branch) beginning July 29, 2026 under VMSA-2026-0006, most recently updated to VMSA-2026-0006.2 on August 19, 2026 to add vCenter/ESX 7.0 patch guidance.
No workarounds are available. Extended-support customers on vCenter 7.0 should contact Broadcom Support directly.
Impact
Unauthorized remote code execution as root on vulnerable VMware vCenter appliances.
Persistent, firewall-evading remote access via outbound command-and-control channels.
Full compromise of the vCenter management plane through rogue SSO administrative account creation, extending attacker control to every ESXi host, VM, and datastore the appliance manages.
Confirmed deployment of Babuk-derived ransomware against ESXi hosts, encrypting VMFS-hosted virtual machine data (large VMDK files partially encrypted, first 512 MB) and rendering affected VMs inoperable.
Destruction of ESXi log telemetry as a side effect of the ransomware deployment, hindering post-incident forensic investigation.
Potential data theft or manipulation across the managed virtual infrastructure.
Continued unauthorized access after patching if pre-existing persistence (cron jobs, web shell, reverse_ssh, rogue SSO accounts) is not identified and removed.
Regulatory obligations under CISA's KEV catalog for federal agencies, and elevated urgency for any organization subject to incident-notification requirements tied to confirmed remote code execution and ransomware deployment on infrastructure-layer systems.
Detection Method
Monitor for unusual outbound SSH connections from vCenter appliances, particularly reverse SSH sessions indicating an outbound C2 channel.
Review vCenter Syslog server logs for directory traversal patterns and anomalous requests consistent with CVE-2026-59310 exploitation.
Inspect crontab entries on vCenter appliances for unauthorized or unexplained scheduled jobs, especially those named to resemble legitimate VMware services (e.g., "vmware-perf-*").
Search the appliance's web server directory for unauthorized JSP files, particularly "vmware-perf-update.jsp" or similarly named files not part of a legitimate VMware release.
Audit vSphere SSO Administrators group membership for unexpected or unexplained account additions, and correlate new admin accounts against known change requests.
Deploy the publicly available QUIRSO YARA rule for identifying reverse_ssh client binaries; because reverse_ssh is a legitimate dual-use tool, treat matches as an investigative lead and correlate with unauthorized installation, execution on vCenter appliances, and unexpected outbound connections.
Review vSphere REST API access logs for anomalous User-Agent strings performing inventory enumeration.
Use available commercial or CISA-published vulnerability scanning capabilities to identify vulnerable, unpatched vCenter systems.
Conduct retrospective log review covering the period since August 3, 2026, for indicators of compromise predating patch deployment.
Perform DFIR analysis on suspected compromised systems, including ESXi hosts, to identify unauthorized binaries, persistence mechanisms, rogue accounts, and signs of ransomware staging.
Indicators of Compromise
Indicator Type | Indicator | Description |
File Hash (SHA-1) | e876ceb47ba092420a97724a957152b3808568b0 | Babuk-derived ransomware encryptor, disguised with the filename "backup" |
Filename | vmware-perf-update.jsp | JSP web shell dropped on compromised vCenter appliance's web server directory |
Cron Job Naming | vmware-perf-collect-*, vmware-perf-sync-* | Cron jobs disguised as legitimate VMware services, used for payload staging and credential theft |
File Extension | .babyk | Extension appended to files encrypted by the Babuk-derived ransomware |
IP Address | 146.59.252[.]178 | Attacker-associated IP linked to rogue SSO administrative account creation |
User-Agent String | GoodMoodle-VCFleet/1.0 | Anomalous User-Agent used to mask vSphere REST API discovery traffic |
User-Agent String | GoodMoodle-VCProbe/1.0 | Anomalous User-Agent associated with vCenter-targeted probing activity |
Indicators sourced from QUIRSO GmbH incident response reporting. As with any published indicator set, validate against your own environment before acting; some elements (e.g., cron job naming, User-Agent strings) may be altered by the actor over time.
Recommendations
Patch immediately: Apply the Broadcom-released updates in VMSA-2026-0006.2 for CVE-2026-59309 and CVE-2026-59310 to all affected vCenter, Cloud Foundation, vSphere Foundation, and Telco Cloud systems.
Assess for prior compromise: Because patching does not remove existing persistence, inspect vCenter appliances for unauthorized cron jobs, JSP web shells, reverse_ssh binaries, rogue SSO administrative accounts, and unexpected outbound SSH connections before and after patching.
Audit ESXi hosts managed by any potentially compromised vCenter instance for signs of ransomware staging or encryption, and verify backup integrity independently of the managed environment.
Isolate compromised assets: Disconnect any vCenter or ESXi system showing indicators of compromise pending investigation.
Reduce attack surface: Restrict network access to vCenter management interfaces, apply network segmentation, and remove unnecessary internet exposure.
Enhance monitoring: Deploy the published reverse_ssh YARA rule, monitor SSO Administrators group membership changes, and watch for anomalous outbound SSH traffic from vCenter systems.
For vCenter 7.0 deployments, contact Broadcom Support directly to obtain applicable patch guidance under an extended support contract.
Strengthen long-term posture: Establish a vCenter-specific incident response plan, conduct regular penetration testing, and maintain a retrospective hunting capability for infrastructure-layer compromises.
Conclusion
This campaign illustrates how a critical vulnerability in a core virtualization management platform can be weaponized within days of disclosure and escalated well beyond initial access. Exploitation of the directory traversal vulnerability in VMware vCenter's Syslog server (CVE-2026-59310) has enabled attackers to establish durable, firewall-evading remote access across 361 IP addresses in 47 countries, progressing through cron-based persistence, web shell deployment, and vmdir credential theft to full takeover of the vCenter SSO management plane. In at least one documented case, that access culminated in Babuk-derived ransomware deployment against ESXi hosts, encrypting VMFS-hosted virtual machine data. QUIRSO has linked the campaign, with moderate confidence, to a Chinese-speaking threat actor, though it has not established attribution to a specific group or nation-state. Because Broadcom has confirmed no workarounds exist, patching under VMSA-2026-0006.2 is the only vendor-supported remediation, and organizations should treat any unpatched, internet-reachable vCenter instance as a near-term target. Because persistence and privilege escalation can predate patch deployment, defenders should pair patching with active hunting for cron, web shell, and rogue SSO account artifacts across both vCenter and ESXi, rather than treating the update alone as sufficient remediation.