Shortly after the release of an emergency patch, attackers began exploiting a critical vulnerability in VMware vCenter. So far, 361 affected IP addresses in 47 countries have been detected. The attackers are using the vulnerability to maintain persistent access to systems via reverse SSH.
The vulnerability is identified as CVE-2026-59310, according to BleepingComputer. It is a vulnerability in vCenter’s Syslog Server. Broadcom disclosed the issue on July 29. An attacker with network access can exploit the vulnerability without valid login credentials and subsequently execute arbitrary code.
There are no temporary workarounds for this vulnerability. Broadcom therefore recommends installing the available updates as soon as possible. The issue has been resolved in vCenter 9.1.0.0300, vCenter 9.0.2.0100, and, for version 8.0, in U3k and U2f.
Attacks followed quickly after patch
Research by incident response firm QUIRSO shows that the first compromised systems made contact with the attackers’ infrastructure on August 3. This means there were only five days between the disclosure of the vulnerability and the observed exploitation.
The number of affected systems then rose rapidly. On August 4, QUIRSO detected 151 new IP addresses, and by the following day, that number had risen to 343. By August 7, a total of 361 IP addresses spread across 47 countries had been identified. More than half of these are located in Germany, the United States, Turkey, Iran, and France.
vCenter’s central role makes the platform an attractive target for attackers. Organizations use the software to manage virtual machines, ESXi hosts, configurations, and access rights, among other things, from a single interface. A successful attack on vCenter can therefore grant access to a significant portion of the virtual infrastructure.
Reverse SSH for persistent access
After gaining access, the attackers install the open-source framework reverse_ssh. They use this to establish an outbound connection from the compromised system to their own infrastructure. This creates a command-and-control channel that allows them to remotely control systems.
Furthermore, this approach can bypass certain network security measures because the connection is established directly from the compromised system itself. This allows attackers to maintain access to the environment even after the initial exploitation.
QUIRSO has made a YARA rule available to detect reverse_ssh client binaries. However, caution is advised: the tool can also be used for legitimate purposes, so detection does not automatically mean that a system has been compromised.
The researchers suspect that an APT group is behind the campaign, but have not yet published any evidence to support this. Specific indicators are also not being shared at this time due to consultations with law enforcement agencies. QUIRSO says it will provide more information later about the attackers’ infrastructure, modus operandi, and activities following the intrusion.