> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access - URL: https://f4n6.co.uk/security-feed/attackers-exploit-vmware-vcenter-vulnerability-to-gain-persistent-remote-access/ - Published: 2026-08-12T16:31:34.000Z - Updated: 2026-08-12T16:31:34.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-59310 ## 1\. Executive summary Threat actors are actively exploiting CVE-2026-59310 (CVSS 9.8, CRITICAL), a path-traversal vulnerability in the VMware vCenter Syslog server, to achieve unauthenticated remote code execution. The vulnerability was patched by Broadcom on July 29, 2026, in advisory VMSA-2026-0006; active exploitation was discovered by QUIRSO during an incident response engagement, with compromised systems first contacting attacker infrastructure on August 3, 2026\. The attack chain leverages the traversal flaw for initial access and deploys a malicious cron job using the open-source `reverse_ssh` tool to establish persistent outbound C2 channels. At least 361 unique victim IP addresses across 47 countries have been identified. The vulnerability is NOT in CISA KEV and EPSS is currently 1%; however, active exploitation in the wild is confirmed. EMEA financial services running exposed or internal vCenter management interfaces face immediate risk of virtualization infrastructure compromise. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | DORA Art. 24: digital operational resilience testing — general requirements | Active exploitation of a CVSS 9.8 unauthenticated RCE in vCenter, a core virtualization management component, within days of patch release | Clients must verify vCenter patch status and exposure as part of resilience testing; unpatched vCenter represents a failed control under operational resilience testing obligations. | | DORA Art. 19: reporting of major ICT-related incidents to competent authorities | Confirmed successful compromise of vCenter servers resulting in persistent remote access via reverse\_ssh | A vCenter compromise impacting virtualization infrastructure availability/integrity likely meets the classification threshold for a major ICT-related incident requiring authority notification. | ## 3\. Technical analysis & attack chain ### Confirmed attack chain (based on QUIRSO incident response findings) 1. **Initial access** — The attacker, possessing network access to the vCenter Server, exploits CVE-2026-59310, a directory-traversal vulnerability in the vCenter Syslog server component. No authentication is required. The vulnerability allows traversal of the syslog service file paths to achieve arbitrary code execution on the vCenter appliance host. 2. **Persistence** — A malicious cron job is deployed on the compromised vCenter host. The cron job executes `reverse_ssh`, an open-source Go-based tool (github.com/NHAS/reverse\_ssh) that establishes an outbound SSH connection from the victim to attacker-controlled infrastructure. This effectively bypasses inbound firewall rules and NAT. 3. **Command and control** — The `reverse_ssh` client initiates an outbound SSH connection to attacker-controlled endpoints. The attacker operates a `reverse_ssh` server, receiving inbound connections from compromised hosts and gaining interactive shell access. C2 contact was first observed on August 3, 2026 — five days after Broadcom's public disclosure on July 29. 4. **Scope of compromise** — QUIRSO identified 361 unique victim IP addresses across 47 countries, with concentrations in Germany, the U.S., Turkey, Iran, and France. ### Vulnerability details - **CVE-2026-59310** — CVSS 9.8 CRITICAL — CWE-22 (Path Traversal) — affects the vCenter Syslog server. Unauthenticated network-based attacker achieves arbitrary code execution. No workarounds exist; vendor patch is the sole remediation. EPSS is 1%; NOT in CISA KEV at time of writing. - **CVE-2026-59309** — CVSS 9.8 CRITICAL — authentication bypass in the VMware Directory Service (vmdir). Allows remote unauthenticated attackers to bypass authentication and access the vCenter management plane. Defused Cyber reports increased scanning targeting this CVE, including version probes via `POST /sdk/` (RetrieveServiceContent) and walks of the `/websso` SAML SSO flow. QUIRSO states there is insufficient evidence to correlate CVE-2026-59309 scanning activity with the CVE-2026-59310 intrusion set. ### Affected products and versions (per VMSA-2026-0006) | Product | Component | Version | Fixed version | | -------------------------------------------- | --------- | ---------------------- | ------------------------ | | VMware Cloud Foundation / vSphere Foundation | vCenter | 9.1.x.x | Refer to vendor advisory | | VMware Cloud Foundation / vSphere Foundation | vCenter | 9.0.x.x | Refer to vendor advisory | | VMware vCenter | N/A | 8.0 | Refer to vendor advisory | | VMware Cloud Foundation | vCenter | 5.x | Async patch to 8.0 U3k | | VMware Telco Cloud Platform | vCenter | 3.0, 4.x, 5.0.x, 5.1.x | Refer to KB449886 | | VMware Telco Cloud Infrastructure | vCenter | 3.0 | Refer to KB449886 | **Attribution caveat:** Attribution is unconfirmed. The Hacker News article references suspected APT involvement and draws parallels to Chinese threat actor UNC5174 and the PurpleHaze cluster (which also used `reverse_ssh`), but no MITRE ATT&CK profile for the actor is available in the verified reference data. The QUIRSO CEO explicitly stated there is insufficient evidence to attribute the campaign. Treat all actor attribution as speculative — single-sourced to The Hacker News reporting; verify before enforcement. **Confidence caveat:** The attack chain, IOC set, and victim count are single-sourced to QUIRSO via The Hacker News. The Rapid7 blog corroborates the vulnerability details and patch information but does not corroborate exploitation activity. Verify before enforcement. ## 4\. Mitigation & containment ### P1 — Within 24 hours 1. **Identify all vCenter Server instances** across the estate, including Cloud Foundation, vSphere Foundation, and Telco Cloud deployments. Inventory versions against the affected list above. 2. **Apply patches per VMSA-2026-0006.** Broadcom states there are no workarounds for CVE-2026-59310 or CVE-2026-59309\. This is the sole remediation path. For Cloud Foundation 5.x, apply the async patch to 8.0 U3k. For Telco Cloud products, refer to KB449886. 3. **Restrict network access** to vCenter management interfaces immediately if not already isolated. vCenter should be reachable only from dedicated management networks via jump hosts. Block all inbound access to vCenter services (ports 443/tcp, 80/tcp, and syslog service ports) from non-management segments. 4. **Hunt for `reverse_ssh` persistence** on all vCenter appliances: - Check cron jobs: `crontab -l` and inspect `/etc/cron.d/`, `/etc/cron.daily/`, `/etc/cron.hourly/`, `/var/spool/cron/` for unexpected entries. - Search for `reverse_ssh` binaries: `find / -name "reverse_ssh*" -o -name "rssh*" 2>/dev/null` \- Identify unexpected outbound SSH connections: `netstat -antp | grep :22` and `ss -antp | grep :22` — focus on outbound ESTABLISHED connections to non-corporate IPs. - Review process listings for unexpected Go binaries or processes named `reverse_ssh`. ### P2 — Within 72 hours 1. **Review vCenter appliance logs** for path-traversal indicators in the syslog service component. Examine `/var/log/vmware/` for anomalous file access patterns or unexpected service restarts. 2. **Audit vmdir authentication logs** for signs of CVE-2026-59309 exploitation — look for unexpected authentication events, SAML token issuance anomalies, or `POST /sdk/` RetrieveServiceContent requests from non-management hosts. 3. **Deploy EDR/monitoring rules** for `reverse_ssh` execution and unexpected cron job creation on vCenter appliances (see §6 detection rules). ### P3 — Within 7 days 1. **Validate patch deployment** across all vCenter and Cloud Foundation instances using InsightVM/Nexpose unauthenticated vulnerability checks (available in Rapid7's July 30 content release) or equivalent scanning. 2. **Conduct retrospective review** of vCenter access logs from July 29 onward to identify any systems that may have been compromised prior to patching. 3. **Update network segmentation policies** to enforce persistent isolation of vCenter management interfaces from general corporate networks. ## 5\. Indicators of compromise No atomic indicators of compromise (IPs, domains, hashes, file paths) are available in the source material. QUIRSO has not published specific IOCs in the referenced reporting. ### Behavioural indicators | Behaviour | Where to observe | Confidence | | ------------------------------------------------------------------------------ | ------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------- | | Unexpected cron job creation on vCenter appliance | /etc/cron.d/, /var/spool/cron/, crontab -l on vCenter appliance OS | High — confirmed in QUIRSO IR findings | | Outbound SSH connection from vCenter appliance to non-corporate infrastructure | Network firewall logs, vCenter appliance netstat/ss output, NDR platform | High — confirmed via reverse\_ssh deployment | | reverse\_ssh binary present on vCenter filesystem | Filesystem search on vCenter appliance, EDR telemetry | High — confirmed deployment method | | Path-traversal activity targeting vCenter Syslog server | vCenter Syslog service logs, WAF/NDR alerts, /var/log/vmware/ | High — consistent with CVE-2026-59310 exploitation | | Version probe via POST /sdk/ (RetrieveServiceContent) | vCenter HTTP access logs, NDR/honeypot telemetry | Medium — observed by Defused Cyber honeypots; associated with CVE-2026-59309 scanning, not confirmed linked to CVE-2026-59310 intrusions | | Walks of /websso SAML SSO flow | vCenter HTTP access logs, WAF logs | Medium — observed by Defused Cyber honeypots; associated with CVE-2026-59309 scanning | ## 6\. Detection ```yara rule QUIRSO_vCenter_reverse_ssh_persistence { meta: author = "Adverse Trace" date = "2026-08-12" reference = "https://thehackernews.com/2026/08/attackers-exploit-vmware-vcenter.html" description = "Detects reverse_ssh tool deployed for persistence on compromised vCenter appliances" strings: $bin_name = "reverse_ssh" ascii nocase $ssh_banner = "SSH-2.0-reverse_ssh" ascii $go_build = "Go build ID" ascii condition: $bin_name or ($ssh_banner and $go_build) } ``` ```yaml title: Suspicious Cron Job Creation on vCenter Appliance id: AT-2026-08-12-520-cron status: experimental description: Detects creation of cron jobs on vCenter appliances, consistent with reverse_ssh persistence observed in CVE-2026-59310 exploitation author: Adverse Trace date: 2026/08/12 references: - https://thehackernews.com/2026/08/attackers-exploit-vmware-vcenter.html logsource: product: linux category: file_event detection: selection_cron_paths: TargetFilename|contains: - "/etc/cron.d/" - "/etc/cron.daily/" - "/etc/cron.hourly/" - "/var/spool/cron/" filter_legitimate: TargetFilename|contains: - "/etc/cron.d/0hourly" - "/etc/cron.daily/man-db" condition: selection_cron_paths and not filter_legitimate falsepositives: - Legitimate administrative cron job creation on vCenter appliance level: high ``` ```yaml title: reverse_ssh Process Execution on vCenter Appliance id: AT-2026-08-12-520-rssh status: experimental description: Detects execution of reverse_ssh tool, used for persistent C2 in CVE-2026-59310 exploitation campaign author: Adverse Trace date: 2026/08/12 references: - https://thehackernews.com/2026/08/attackers-exploit-vmware-vcenter.html logsource: product: linux category: process_creation detection: selection: Image|contains: - "reverse_ssh" CommandLine|contains: - "reverse_ssh" condition: selection falsepositives: - Legitimate administrative use of reverse_ssh tool (QUIRSO notes presence alone is not proof of malicious activity) level: high ``` ## CVE assessment 1 referenced CVE — 1 critical (CVSS ≥ 9.0) | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | ------------ | --------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-59310](https://nvd.nist.gov/vuln/detail/CVE-2026-59310?ref=f4n6.co.uk) | 9.8 Critical | — | 1% | VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCen… | ## 7\. Sources - The Hacker News — "Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access" — https://thehackernews.com/2026/08/attackers-exploit-vmware-vcenter.html — 2026-08-12 - Rapid7 — "Critical VMware vCenter Vulnerabilities Allow Authentication Bypass and Remote Code Execution (CVE-2026-59309, CVE-2026-59310)" — https://www.rapid7.com/blog/post/etr-critical-vmware-vcenter-vulnerabilities-allow-authentication-bypass-and-remote-code-execution-cve-2026-59309-cve-2026-59310 — 2026-07-30 ## 8\. Adverse Trace position CVE-2026-59310 is a CVSS 9.8 CRITICAL unauthenticated RCE in vCenter Syslog server with confirmed active exploitation in the wild, despite an EPSS of 1% and absence from CISA KEV. The attack chain is straightforward — network access to vCenter, path traversal to code execution, cron-based persistence via `reverse_ssh` — and the five-day gap between patch release and first observed compromise indicates rapid threat actor weaponisation. EMEA financial services running affected vCenter versions (8.0, 9.0.x, 9.1.x, Cloud Foundation 5.x, Telco Cloud) must treat patching as an emergency operation. Attribution is unconfirmed and single-sourced; we are not treating the APT designation or UNC5174/PurpleHaze parallels as corroborated. We will monitor for QUIRSO's full technical report and any IOC publications, track CVE-2026-59309 scanning activity for escalation to confirmed exploitation, and update clients if CISA KEV listing occurs or additional IOCs emerge. --- [Read the original source →](https://thehackernews.com/2026/08/attackers-exploit-vmware-vcenter.html?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*