Quick Takeaways
- Threat actors are actively exploiting the CVE-2026-59310 directory-traversal vulnerability in VMware vCenter to execute arbitrary code and establish persistence using reverse SSH connections.
- Over 360 IP addresses across 47 countries, mainly Germany, the US, Turkey, Iran, and France, have been compromised since the flaw’s disclosure, indicating widespread targeted campaigns.
- Increased scanning activity suggests ongoing attempts to exploit related vulnerabilities (CVE-2026-59309), highlighting escalating attacks on VMware vCenter security infrastructure.
Threat, Techniques, and Targets
Threat actors are actively exploiting a newly disclosed vulnerability in VMware vCenter, known as CVE-2026-59310. This is a critical security flaw with a CVSS score of 9.8. The vulnerability is a directory-traversal flaw that allows attackers to run any code they want on vulnerable systems. They can do this if they have network access to the vCenter server. Once exploited, attackers deploy malicious tools like cron jobs to gain and keep access. They use tools such as reverse_ssh to create secure outbound connections to their own servers. This helps them control infected systems without detection. The activity started just five days after the vulnerability was made public. As many as 361 IP addresses in 47 countries, including Germany, the U.S., Turkey, Iran, and France, are affected. Most likely, these actors are a sophisticated advanced persistent threat (APT) group.
Impact, Security Implications, and Remediation
The exploitation of this vulnerability can lead to serious consequences. Attackers can gain long-term access to systems and run malicious commands or steal data. The use of reverse_ssh makes it easier for attackers to hide their activities and bypass security defenses. This increases the risk of cyber espionage and data breaches. Organizations should act quickly. They need to patch their VMware vCenter servers to fix the vulnerability. If systems are already compromised, security teams should look for signs of unauthorized access, like unexpected outbound connections or suspicious cron jobs. Since the details of the fix are from the vendor, organizations should obtain specific remediation guidance from Broadcom or official cybersecurity sources. Prompt patching and thorough monitoring are essential to defend against these threats.
Continue Your Tech Journey
Stay informed on the revolutionary breakthroughs in Quantum Computing research.
Access comprehensive resources on technology by visiting Wikipedia.
ThreatIntel-V1
