VMware vCenter CVE-2026-59310 Under Global APT Exploitation

Every platform lead running a virtualized estate has one nightmare bookmarked: an unauthenticated RCE in the hypervisor management plane. That nightmare has a CVE number this month, and it is already being exploited across 47 countries by a single suspected APT.

The short version: VMware disclosed CVE-2026-59310 on July 29. By August 3, a threat actor was inside real production environments. By August 4, activity peaked. And the attacker planted persistence that survives the patch you were about to deploy.

What Happened

CVE-2026-59310 is a critical directory traversal flaw in VMware vCenter with a CVSS score of 9.8. As Dark Reading reported, Broadcom-owned VMware disclosed the vulnerability on July 29, warning that any attacker with network access to a vCenter instance could remotely execute arbitrary code inside the target's virtual environment. That is the worst class of vCenter bug: unauthenticated, remote, and pointed at the control plane of the whole hypervisor fleet.

Five days later, on August 3, exploitation began. German incident-response firm QUIRSO uncovered the activity during a customer engagement and published its findings this week. Their Threat Research team attributes the campaign to a single suspected advanced persistent threat actor, and traced infrastructure hits across 47 different countries. The United States, France, Iran, and Turkey are the most heavily targeted. QUIRSO identified 361 unique IP addresses connecting into the campaign, though the firm noted some belong to cloud or hosting providers sharing infrastructure, so victim count is not a one-to-one mapping.

The campaign peaked on August 4 and is still running. "We are still seeing new victims connecting to the attacker-controlled reverse_ssh infrastructure, and the attackers appear to be unaware that we are monitoring it," QUIRSO COO and co-founder Denis Szadkowski told Dark Reading. He added that new victims keep appearing, just at a slower pace as the unpatched pool shrinks. QUIRSO also flags the possibility that the actor knew about the flaw before public disclosure, though the timing lines up cleanly with patch-diffing after the advisory dropped. You can look up the record in the CVE database and it belongs on the CISA KEV list if it isn't already.

Technical Anatomy

Directory traversal into RCE on a management plane is not exotic. What matters here is the second stage. The threat actor is establishing post-exploitation persistence through reverse_ssh, an open-source penetration-testing tool that creates outbound control channels from compromised systems. Outbound. That is the whole trick.

Most vCenter deployments I've seen in production are locked down on ingress. Management VLANs, jump hosts, IP allowlists on 443. But egress from the vCenter appliance itself? Usually wide open to whatever the appliance needs for updates, telemetry, and NTP. reverse_ssh weaponizes that asymmetry. The compromised vCenter reaches out to attacker infrastructure and holds a control channel open. Your firewall sees an established outbound session, not an inbound intrusion.

Here is the operationally nasty part: patching CVE-2026-59310 does not evict the attacker. Szadkowski was explicit that if reverse_ssh was planted before you patched, "the attacker's access will persist even after the software is updated to a fixed version." The tunnel lives outside the vulnerable code path. Once you have a foothold and outbound reachability, you don't need the bug anymore.

Szadkowski also punctures the assumption that only VMware specialists could pull this off in five days. "Skilled vulnerability researchers and advanced actors commonly perform patch diffing after disclosure. We believe it is reasonable that a sufficiently skilled researcher could analyze the patch and develop an exploit within the five days between the advisory and the intrusion we investigated." Translation: the moment Broadcom shipped the fix, the countdown started. QUIRSO has published a YARA rule for identifying reverse_ssh builds, which maps neatly onto MITRE ATT&CK techniques for remote access tooling and command-and-control channels.

My take: the industry keeps treating "N-day" like it means weeks. Five days is the new N-day for anything with a 9.8 CVSS and a Broadcom logo.

Who Gets Burned

vCenter is the crown jewel of most enterprise virtualization estates. In production incidents I've seen at fintech and iGaming operators, a single compromised vCenter is not one server, it's authority over every VM, every datastore, every network policy that vCenter manages. Matt Snyder, principal engineer and detection and response lead at Aviatrix, put it bluntly: "If a bad actor targets vCenter, the blast radius of a single unauthenticated RCE isn't one application; it's the whole estate."

The teams most exposed right now are the ones with the biggest maintenance-window problem. Regulated verticals, iGaming platforms mid-tournament, payment processors in high-volume windows, any shop where downtime negotiation eats weeks. Snyder's diagnosis of why organizations lag on patching is uncomfortably accurate: "because the maintenance window is a conversation nobody wants to have." Five days from disclosure to exploitation gave essentially zero shops in those categories time to run their normal change process.

The uncomfortable read: if your vCenter was internet-adjacent or reachable from a compromised jump host on July 29, and you patched on, say, August 6, you are not necessarily safe. You are potentially patched and compromised. That is a very different tabletop exercise. Forensic triage on the vCenter appliances themselves, not just confirming the version string, is the only way to know.

Geographic concentration matters too. Teams in the US, France, Iran, and Turkey are the top targets by QUIRSO's telemetry. If your infrastructure lives in one of those jurisdictions and you run vCenter with any external management reachability, escalate this above a routine ticket. This is a board-visible incident risk, not a Tuesday patch.

Playbook for Security Teams

Do these things this week. Not this sprint, this week.

• Patch vCenter to the fixed version now. If you have not applied the July 29 advisory fix, that is the first move. Every day the unpatched pool shrinks, per QUIRSO, which means late-patchers are increasingly the outliers.
• Assume patched does not mean clean. Run QUIRSO's published YARA rule for reverse_ssh builds against your vCenter appliances and any hosts adjacent to them. Do it before you close the change ticket.
• Kill outbound from vCenter. Snyder's point: "This operational lag is why defense strategies must center on network containment as the primary line of defense." vCenter appliances should not have general internet egress. Allowlist the exact update and telemetry endpoints Broadcom requires, drop everything else.
• Hunt for outbound SSH-shaped traffic from vCenter and ESXi management interfaces to unfamiliar destinations. reverse_ssh's whole design is to look like a normal outbound session, so look at destination reputation and connection duration, not just protocol.
• Rotate credentials that touched the appliance. If persistence was established, any secrets stored, cached, or typed into vCenter within the exploitation window should be considered exposed.
• Book the forensic conversation now. As Szadkowski said, "It is essentially a race between exploitation and patching. We therefore recommend a forensic investigation of potentially affected systems to rule out an existing compromise." If you can't do it internally, get an IR retainer engaged before your incident-response budget becomes an emergency purchase order.

Verdict: patch, contain egress, hunt for persistence, rotate secrets. In that order. Anything less is optimism dressed as strategy.

Key Takeaways

• CVE-2026-59310 is a 9.8-CVSS directory traversal in VMware vCenter, disclosed July 29 and under active exploitation since August 3, five days later.
• A single suspected APT is running the campaign across 47 countries, with 361 unique IPs observed and the US, France, Iran, and Turkey as top targets.
• reverse_ssh persistence means patching does not evict the attacker. Forensic review of vCenter appliances is required, not optional.
• Five days from disclosure to exploitation is the new baseline for high-CVSS bugs in ubiquitous enterprise software. Change-management windows measured in weeks are no longer a defense.
• Egress restrictions on management plane appliances are the containment control that would have blunted this campaign. If your vCenter can reach the open internet, fix that this quarter.