Attacks on VMware vCenter by path traversal gap

Attackers have exploited a critical vulnerability in VMware vCenter’s Syslog Server, enabling them to inject and execute malicious code. The breach was identified by cybersecurity researchers at Quirso, who detailed their findings on the Medium platform. The flaw, known as CVE-2026-59310 with a CVSS score of 9.8 and classified as critical, allows attackers to bypass security measures through a path-traversal vulnerability. Broadcom, which acquired VMware, issued a patch in early July this year, urging users to update their systems to versions including vCenter 9.1.0.0300, 9.0.2.0100, 8.0 U3k, and 8.0 U2f. However, there are no temporary mitigations available, and only applying these updates can effectively close the exploit. The researchers analyzed compromised devices and discovered a large number of affected systems. As of Tuesday this week, they identified 361 IP addresses associated with compromised VMware vCenter instances. Of these, 55 were located in Germany, followed by the United States with 41 addresses and Turkey with 38. The attack campaign began shortly after the vulnerability was disclosed on July 29. The first infected systems contacted the attacker's infrastructure five days later, starting on August 3. Within two days, 343 of the 361 IP addresses had already been detected. The attackers used a technique called "reverse_ssh," an open-source SSH-based reverse-shell framework typically employed during penetration testing. This tool enables automated connections, port forwarding, file transfer, and remote shell management. These capabilities allowed the attackers to maintain persistent access within the compromised networks. IT administrators are advised to verify whether their VMware vCenter Syslog Servers are up to date and to monitor for unexpected software such as reverse_ssh running on their systems. The exploitation of this vulnerability highlights the importance of timely patch management in enterprise environments. Many organizations rely heavily on VMware vCenter for managing virtualized infrastructures, making them prime targets for cybercriminals seeking to gain unauthorized access. The scale of the compromise suggests that the attack may have been orchestrated by well-resourced actors capable of deploying sophisticated techniques to evade detection. Security experts warn that while the immediate threat has been mitigated by updating systems, the potential for long-term damage remains. Compromised systems could serve as entry points for further attacks, potentially leading to data breaches, ransomware deployment, or other forms of cybercrime. The presence of reverse_ssh indicates that the attackers may have established a foothold within the network, allowing them to move laterally and exfiltrate sensitive information. As the situation unfolds, IT professionals are urged to conduct thorough audits of their infrastructure and implement additional monitoring tools to detect anomalous activity. The lack of public disclosure regarding ongoing attacks means that many organizations may still be unaware of their exposure. While Broadcom has released patches, the effectiveness of these solutions depends on prompt action from system administrators. Until all vulnerable systems are patched, the risk of continued exploitation persists.