Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access

1. Executive summary

Threat actors are actively exploiting CVE-2026-59310 (CVSS 9.8, CRITICAL), a path-traversal vulnerability in the VMware vCenter Syslog server, to achieve unauthenticated remote code execution. The vulnerability was patched by Broadcom on July 29, 2026, in advisory VMSA-2026-0006; active exploitation was discovered by QUIRSO during an incident response engagement, with compromised systems first contacting attacker infrastructure on August 3, 2026. The attack chain leverages the traversal flaw for initial access and deploys a malicious cron job using the open-source reverse_ssh tool to establish persistent outbound C2 channels. At least 361 unique victim IP addresses across 47 countries have been identified. The vulnerability is NOT in CISA KEV and EPSS is currently 1%; however, active exploitation in the wild is confirmed. EMEA financial services running exposed or internal vCenter management interfaces face immediate risk of virtualization infrastructure compromise.

2. Regulatory framing

3. Technical analysis & attack chain

Confirmed attack chain (based on QUIRSO incident response findings)

1. Initial access — The attacker, possessing network access to the vCenter Server, exploits CVE-2026-59310, a directory-traversal vulnerability in the vCenter Syslog server component. No authentication is required. The vulnerability allows traversal of the syslog service file paths to achieve arbitrary code execution on the vCenter appliance host.
2. Persistence — A malicious cron job is deployed on the compromised vCenter host. The cron job executes reverse_ssh, an open-source Go-based tool (github.com/NHAS/reverse_ssh) that establishes an outbound SSH connection from the victim to attacker-controlled infrastructure. This effectively bypasses inbound firewall rules and NAT.
3. Command and control — The reverse_ssh client initiates an outbound SSH connection to attacker-controlled endpoints. The attacker operates a reverse_ssh server, receiving inbound connections from compromised hosts and gaining interactive shell access. C2 contact was first observed on August 3, 2026 — five days after Broadcom's public disclosure on July 29.
4. Scope of compromise — QUIRSO identified 361 unique victim IP addresses across 47 countries, with concentrations in Germany, the U.S., Turkey, Iran, and France.

Vulnerability details

• CVE-2026-59310 — CVSS 9.8 CRITICAL — CWE-22 (Path Traversal) — affects the vCenter Syslog server. Unauthenticated network-based attacker achieves arbitrary code execution. No workarounds exist; vendor patch is the sole remediation. EPSS is 1%; NOT in CISA KEV at time of writing.
• CVE-2026-59309 — CVSS 9.8 CRITICAL — authentication bypass in the VMware Directory Service (vmdir). Allows remote unauthenticated attackers to bypass authentication and access the vCenter management plane. Defused Cyber reports increased scanning targeting this CVE, including version probes via POST /sdk/ (RetrieveServiceContent) and walks of the /websso SAML SSO flow. QUIRSO states there is insufficient evidence to correlate CVE-2026-59309 scanning activity with the CVE-2026-59310 intrusion set.

Affected products and versions (per VMSA-2026-0006)

Attribution caveat: Attribution is unconfirmed. The Hacker News article references suspected APT involvement and draws parallels to Chinese threat actor UNC5174 and the PurpleHaze cluster (which also used reverse_ssh), but no MITRE ATT&CK profile for the actor is available in the verified reference data. The QUIRSO CEO explicitly stated there is insufficient evidence to attribute the campaign. Treat all actor attribution as speculative — single-sourced to The Hacker News reporting; verify before enforcement.

Confidence caveat: The attack chain, IOC set, and victim count are single-sourced to QUIRSO via The Hacker News. The Rapid7 blog corroborates the vulnerability details and patch information but does not corroborate exploitation activity. Verify before enforcement.

4. Mitigation & containment

P1 — Within 24 hours

1. Identify all vCenter Server instances across the estate, including Cloud Foundation, vSphere Foundation, and Telco Cloud deployments. Inventory versions against the affected list above.
2. Apply patches per VMSA-2026-0006. Broadcom states there are no workarounds for CVE-2026-59310 or CVE-2026-59309. This is the sole remediation path. For Cloud Foundation 5.x, apply the async patch to 8.0 U3k. For Telco Cloud products, refer to KB449886.
3. Restrict network access to vCenter management interfaces immediately if not already isolated. vCenter should be reachable only from dedicated management networks via jump hosts. Block all inbound access to vCenter services (ports 443/tcp, 80/tcp, and syslog service ports) from non-management segments.
4. Hunt for reverse_ssh persistence on all vCenter appliances: - Check cron jobs: crontab -l and inspect /etc/cron.d/, /etc/cron.daily/, /etc/cron.hourly/, /var/spool/cron/ for unexpected entries. - Search for reverse_ssh binaries: find / -name "reverse_ssh*" -o -name "rssh*" 2>/dev/null - Identify unexpected outbound SSH connections: netstat -antp | grep :22 and ss -antp | grep :22 — focus on outbound ESTABLISHED connections to non-corporate IPs. - Review process listings for unexpected Go binaries or processes named reverse_ssh.

P2 — Within 72 hours

5. Review vCenter appliance logs for path-traversal indicators in the syslog service component. Examine /var/log/vmware/ for anomalous file access patterns or unexpected service restarts.
6. Audit vmdir authentication logs for signs of CVE-2026-59309 exploitation — look for unexpected authentication events, SAML token issuance anomalies, or POST /sdk/ RetrieveServiceContent requests from non-management hosts.
7. Deploy EDR/monitoring rules for reverse_ssh execution and unexpected cron job creation on vCenter appliances (see §6 detection rules).

P3 — Within 7 days

8. Validate patch deployment across all vCenter and Cloud Foundation instances using InsightVM/Nexpose unauthenticated vulnerability checks (available in Rapid7's July 30 content release) or equivalent scanning.
9. Conduct retrospective review of vCenter access logs from July 29 onward to identify any systems that may have been compromised prior to patching.
10. Update network segmentation policies to enforce persistent isolation of vCenter management interfaces from general corporate networks.

5. Indicators of compromise

No atomic indicators of compromise (IPs, domains, hashes, file paths) are available in the source material. QUIRSO has not published specific IOCs in the referenced reporting.

Behavioural indicators

6. Detection

rule QUIRSO_vCenter_reverse_ssh_persistence {
  meta:
    author = "Adverse Trace"
    date = "2026-08-12"
    reference = "https://thehackernews.com/2026/08/attackers-exploit-vmware-vcenter.html"
    description = "Detects reverse_ssh tool deployed for persistence on compromised vCenter appliances"
  strings:
    $bin_name = "reverse_ssh" ascii nocase
    $ssh_banner = "SSH-2.0-reverse_ssh" ascii
    $go_build = "Go build ID" ascii
  condition:
    $bin_name or ($ssh_banner and $go_build)
}

title: Suspicious Cron Job Creation on vCenter Appliance
id: AT-2026-08-12-520-cron
status: experimental
description: Detects creation of cron jobs on vCenter appliances, consistent with reverse_ssh persistence observed in CVE-2026-59310 exploitation
author: Adverse Trace
date: 2026/08/12
references:

  - https://thehackernews.com/2026/08/attackers-exploit-vmware-vcenter.html
logsource:
  product: linux
  category: file_event
detection:
  selection_cron_paths:
    TargetFilename|contains:

      - "/etc/cron.d/"
      - "/etc/cron.daily/"
      - "/etc/cron.hourly/"
      - "/var/spool/cron/"
  filter_legitimate:
    TargetFilename|contains:

      - "/etc/cron.d/0hourly"
      - "/etc/cron.daily/man-db"
  condition: selection_cron_paths and not filter_legitimate
falsepositives:

  - Legitimate administrative cron job creation on vCenter appliance
level: high

title: reverse_ssh Process Execution on vCenter Appliance
id: AT-2026-08-12-520-rssh
status: experimental
description: Detects execution of reverse_ssh tool, used for persistent C2 in CVE-2026-59310 exploitation campaign
author: Adverse Trace
date: 2026/08/12
references:

  - https://thehackernews.com/2026/08/attackers-exploit-vmware-vcenter.html
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|contains:

      - "reverse_ssh"
    CommandLine|contains:

      - "reverse_ssh"
  condition: selection
falsepositives:

  - Legitimate administrative use of reverse_ssh tool (QUIRSO notes presence alone is not proof of malicious activity)
level: high

CVE assessment

1 referenced CVE — 1 critical (CVSS ≥ 9.0)

7. Sources

• The Hacker News — "Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access" — https://thehackernews.com/2026/08/attackers-exploit-vmware-vcenter.html — 2026-08-12
• Rapid7 — "Critical VMware vCenter Vulnerabilities Allow Authentication Bypass and Remote Code Execution (CVE-2026-59309, CVE-2026-59310)" — https://www.rapid7.com/blog/post/etr-critical-vmware-vcenter-vulnerabilities-allow-authentication-bypass-and-remote-code-execution-cve-2026-59309-cve-2026-59310 — 2026-07-30

8. Adverse Trace position

CVE-2026-59310 is a CVSS 9.8 CRITICAL unauthenticated RCE in vCenter Syslog server with confirmed active exploitation in the wild, despite an EPSS of 1% and absence from CISA KEV. The attack chain is straightforward — network access to vCenter, path traversal to code execution, cron-based persistence via reverse_ssh — and the five-day gap between patch release and first observed compromise indicates rapid threat actor weaponisation. EMEA financial services running affected vCenter versions (8.0, 9.0.x, 9.1.x, Cloud Foundation 5.x, Telco Cloud) must treat patching as an emergency operation. Attribution is unconfirmed and single-sourced; we are not treating the APT designation or UNC5174/PurpleHaze parallels as corroborated. We will monitor for QUIRSO's full technical report and any IOC publications, track CVE-2026-59309 scanning activity for escalation to confirmed exploitation, and update clients if CISA KEV listing occurs or additional IOCs emerge.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.