CVE-2026-59310 has moved from a critical VMware vulnerability that administrators needed to patch quickly to a vulnerability defenders need to treat as a potential incident-response problem.
Broadcom disclosed CVE-2026-59310 on July 29, 2026 as a critical directory traversal vulnerability in the VMware vCenter Syslog server. The company assigned it a CVSS v3.1 base score of 9.8 and stated that a malicious actor with network access to vCenter could exploit the flaw to execute arbitrary code. The CVSS vector is एवी:नहीं/एसी:लंबा/पीआर:नहीं/यूआई:नहीं/एस:अनुपलब्ध/सी:ऊँचा/आई:ऊँचा/ए:ऊँचा, indicating network-based exploitation, low attack complexity, no required privileges, and no user interaction. (Support Portal)
The risk changed materially in August.
On August 12, NHS England’s National Cyber Security Operations Centre updated its advisory to state that researchers had observed exploitation of CVE-2026-59310 and that successful attacks involved the use of reverse SSH to maintain access to compromised vCenter systems. NHS England assessed further exploitation as likely. (एनएचएस इंग्लैंड डिजिटल)
Separately, incident-response company QUIRSO reported forensic evidence linking successful vCenter compromises to CVE-2026-59310. According to reporting based on its investigation, compromised systems began communicating with attacker-controlled infrastructure on August 3, only five days after Broadcom’s public disclosure. By August 7, QUIRSO had identified 361 victim IP addresses across 47 countries. Those figures should be understood as QUIRSO’s observed dataset rather than a measurement of every compromised system globally. (ब्लिपिंगकंप्यूटर)
For organizations operating VMware infrastructure, the security question is therefore no longer simply:
“Are we running a vulnerable version?”
It is also:
“Was this vCenter reachable by an attacker before we patched it, and is there evidence that it was already compromised?”
What Is CVE-2026-59310?
CVE-2026-59310 is a directory traversal vulnerability affecting the Syslog server component of VMware vCenter Server.
Broadcom’s description is short but unusually consequential:
A malicious actor with network access to vCenter may exploit the vulnerability to execute arbitrary code. Broadcom rates it Critical with a maximum CVSS v3.1 score of 9.8. (Support Portal)
The NVD currently maps the vulnerability to CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal. It also reproduces VMware’s CVSS vector showing that exploitation does not require prior privileges or user interaction. (National Vulnerability Database)
The core characteristics are therefore:
Property
CVE-2026-59310
उत्पाद
VMware vCenter Server
Vulnerable component
Syslog server
संवेदनशीलता वर्ग
Directory traversal
सामूहिक रूप से
CWE-22
प्रभाव
Arbitrary code execution
CVSS v3.1
9.8 Critical
Attack vector
Network
Attack complexity
कम
Authentication required
नहीं
User interaction
नहीं
Workaround
None
Active exploitation
Reported
The distinction between network accessible और internet accessible matters. An organization does not need to expose its vCenter management interface directly to the public Internet for this vulnerability to remain dangerous. An attacker who has already obtained access to a corporate network, management VPN, administrative subnet, compromised jump host, or another system capable of reaching vCenter may potentially satisfy the network-access requirement.
Rapid7 made the same point when analyzing the vulnerability: restricting vCenter to internal or dedicated management networks reduces exposure to Internet attackers, but it does not eliminate the threat once an adversary already has access to the organization’s network. (रैपिड7)
Why Can a Directory Traversal Vulnerability Become RCE?
The phrase “directory traversal” can make CVE-2026-59310 sound less severe than it actually is.
Traditional path traversal vulnerabilities are associated with input such as:
../../../../...
that causes an application to resolve a path outside the directory it intended to access.
Depending on the affected operation, a path traversal flaw may enable unauthorized file reading, writing, replacement, deletion, or interaction with security-sensitive filesystem locations.
For CVE-2026-59310, however, defenders should avoid inventing undocumented exploit mechanics.
Broadcom has publicly confirmed both the vulnerability class and its ultimate security impact: the bug exists in the vCenter Syslog server, involves directory traversal, and can allow an attacker with network access to execute arbitrary code. Broadcom has not publicly documented the complete internal exploit primitive or every filesystem operation involved in the transition from traversal to code execution. (Support Portal)
That distinction matters.
It would be inaccurate to claim, without evidence, that the vulnerability necessarily works by uploading a specific file, modifying a particular script, overwriting a cron configuration, or targeting a specific path inside the appliance.
What can be established is the security boundary that failed:
The real-world exploitation reported by incident responders provides a separate view of what attackers did after obtaining execution: they established persistence using reverse SSH tooling. It does not by itself reveal every technical detail of the vulnerability primitive. (ब्लिपिंगकंप्यूटर)
CVE-2026-59310 Is an Unauthenticated VMware vCenter RCE
One of the most important characteristics of CVE-2026-59310 is that an attacker does not need a legitimate VMware administrator account before exploiting it.
The CVSS vector supplied by VMware specifies:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The relevant fields are:
AV:N Network attack vector
AC:L Low attack complexity
PR:N No privileges required
UI:N No user interaction required
Rapid7 likewise describes CVE-2026-59310 and the adjacent CVE-2026-59309 as remotely exploitable vCenter vulnerabilities that can be exploited by unauthenticated attackers who have network access to a vulnerable server. (National Vulnerability Database)
That combination explains the 9.8 severity score.
An attacker does not first need to steal a VMware administrator password, persuade an administrator to open a file, or compromise an ordinary VM.
They need a path to the vulnerable vCenter service.
Why Compromising vCenter Is Especially Dangerous
vCenter is not an ordinary application server.
It is the centralized management plane used to administer VMware virtual infrastructure, including ESXi hosts, virtual machines, resource allocation, configurations, permissions, and other virtualization operations. (रैपिड7)
Consequently, successful code execution on the vCenter appliance can place an attacker inside one of the most security-sensitive control planes in an enterprise environment.
The exact downstream impact still depends on configuration, credentials available to the compromised system, topology, segmentation, and the attacker’s subsequent actions. CVE-2026-59310 should therefore not be described as automatically compromising every virtual machine in a VMware environment.
But the strategic position of vCenter makes the compromise particularly serious.
A useful security model is:
Corporate Network
│
├── Application Server
│
├── Database Server
│
├── User Workstations
│
└── VMware Management Network
│
▼
vCenter Server
│
┌─────────┼─────────┐
▼ ▼ ▼
ESXi ESXi ESXi
│ │ │
VMs VMs VMs
Compromise of an ordinary workload starts at the workload layer.
Compromise of a virtualization management plane starts much closer to the infrastructure control layer.
This is why defenders should treat suspected vCenter RCE exploitation as a high-priority incident even if no ransomware, data destruction, or VM manipulation has yet been observed.
CVE-2026-59310 Active Exploitation Timeline
The exploitation timeline is one of the most important parts of this vulnerability.
July 29, 2026 — Broadcom Discloses CVE-2026-59310
Broadcom published VMSA-2026-0006 on July 29, covering several VMware vulnerabilities, including CVE-2026-59310 and another critical vCenter vulnerability, CVE-2026-59309. (Support Portal)
At disclosure time, Broadcom’s accompanying FAQ said it had no information suggesting exploitation had occurred in the wild. (Bitly)
Rapid7 similarly reported on July 30 that there was no known evidence of exploitation or scanning at that point. (रैपिड7)
August 3 — First Observed Victim Communications
According to QUIRSO’s incident-response findings reported by BleepingComputer and The Hacker News, compromised systems began connecting to attacker-controlled infrastructure on August 3, five days after public disclosure. (ब्लिपिंगकंप्यूटर)
August 4–7 — Campaign Expands
BleepingComputer reports that QUIRSO observed 151 additional victim IP addresses on August 4. By August 5, its dataset had reached 343 victim IPs, eventually reaching 361 by August 7. (ब्लिपिंगकंप्यूटर)
August 12 — Government Cyber Advisory Confirms Observed Exploitation
NHS England updated its advisory on August 12 and explicitly stated:
security researchers had observed exploitation of CVE-2026-59310;
successful exploitation involved reverse SSH being used to maintain access;
This is important because Broadcom’s FAQ still contains its earlier statement that the vendor had no information indicating in-the-wild exploitation. That statement reflects the information available when the FAQ was written and should not be interpreted as disproving the later incident-response evidence. (Bitly)
For defenders, the newer threat intelligence materially changes prioritization.
What Attackers Are Doing After Exploiting CVE-2026-59310
CVE-2026-59310 Attack Chain: From Syslog Traversal to Reverse SSH Persistence
QUIRSO’s investigation provides a useful view into post-exploitation behavior.
According to the researchers, activity consistent with exploitation of CVE-2026-59310 was followed by installation of a malicious cron job and deployment of reverse_ssh, an open-source reverse SSH framework. (द हैकर न्यूज़)
The important operational feature of reverse SSH is that the compromised machine initiates the connection outward.
Instead of requiring the attacker to repeatedly establish a suspicious inbound administrative connection, the compromised appliance connects to infrastructure controlled by the attacker.
That can make traditional perimeter controls less effective when outbound traffic from management infrastructure is insufficiently restricted. The Hacker News notes that this outbound connection model can help bypass defenses primarily designed to stop unsolicited inbound traffic. (द हैकर न्यूज़)
reverse_ssh Does Not Automatically Mean Malware
Defenders should also avoid the opposite error: treating every copy of reverse_ssh as definitive evidence of compromise.
The tool is open source and has legitimate uses.
QUIRSO has published a generic YARA rule intended to identify standard builds of the NHAS reverse_ssh client, but the rule itself explicitly warns that the software is dual use and that maliciousness must be established from deployment context and telemetry. (गिटहब)
The detection therefore becomes much more meaningful when multiple signals appear together:
That combination should trigger immediate investigation.
The presence of a reverse SSH binary without the supporting context should be treated as a lead, not a conviction.
Affected VMware vCenter Versions
Broadcom’s VMSA response matrix provides the authoritative remediation mapping.
As of the current advisory, the relevant fixed vCenter versions include: (Support Portal)
VMware product / branch
CVE-2026-59310 fixed version
VMware Cloud Foundation / vSphere Foundation vCenter 9.1.x
9.1.0.0300
VMware Cloud Foundation / vSphere Foundation vCenter 9.0.x
9.0.2.0100
VMware vCenter 8.0 U3 branch
8.0 U3k
VMware vCenter 8.0 U2 branch
8.0 U2f
VMware Cloud Foundation 5.x
Async patch to 8.0 U3k
VMware Telco Cloud Platform
Follow Broadcom KB449886
VMware Telco Cloud Infrastructure
Follow Broadcom KB449886
Broadcom notes that patches are cumulative, so versions newer than the listed fixed releases also contain the security fixes. (Bitly)
The advisory also explicitly states that there is no workaround for CVE-2026-59310. (Support Portal)
That point should drive remediation decisions.
Network segmentation may reduce exposure, and firewall policy may make exploitation more difficult from some locations, but neither constitutes the vendor fix.
What About vSphere 7, 6.7, or Other Older Releases?
Organizations running older VMware releases need to pay particular attention.
Broadcom’s FAQ says that vSphere 6.5 and 6.7 are beyond General Support and are not evaluated as part of current security advisories. Broadcom advises customers to presume those down-level releases are affected rather than assuming that absence from the response matrix means safety. (Bitly)
VMware vSphere 7 reached End of General Support on October 2, 2025. Broadcom states that organizations with extended support contracts should use those processes to request relevant fixes, while encouraging migration to supported releases. (Bitly)
This produces an important rule for vulnerability management:
Not listed as patched is not equivalent to not vulnerable.
For unsupported software, the absence of testing and security releases frequently creates more uncertainty, not less.
How to Check Your vCenter Version
Broadcom’s FAQ provides two simple methods for verifying the current vCenter build.
The build information can be viewed in the Summary tab of the vSphere Client.
Administrators using PowerCLI can connect to the vCenter instance:
Broadcom documents these variables specifically as methods for checking vCenter version and build information. (Bitly)
This is safer than attempting to “validate” vulnerability status by firing public exploit payloads against production infrastructure.
For CVE-2026-59310, the first validation question should be version-based:
What version/build am I running?
↓
Is it older than Broadcom's fixed version?
↓
Yes → Treat as vulnerable and patch
No → Confirm update completed successfully
Exploit-based validation should only occur in an isolated, explicitly authorized testing environment where the potential impact has been understood.
CVE-2026-59309 and CVE-2026-59310 Were Patched Together
CVE-2026-59310 was not the only critical vCenter vulnerability disclosed in VMSA-2026-0006.
Broadcom also disclosed CVE-2026-59309, an authentication bypass in VMware Directory Service.
The two vulnerabilities have the same CVSS v3.1 score of 9.8 but affect different security boundaries:
सीवीई
अवयव
संवेदनशीलता
Result
CVE-2026-59309
VMware Directory Service
Authentication bypass
Unauthorized access
CVE-2026-59310
vCenter Syslog server
Directory traversal
Arbitrary code execution
Broadcom states that CVE-2026-59309 can allow a malicious actor with network access to bypass authentication, while CVE-2026-59310 can allow a network attacker to execute arbitrary code. (Support Portal)
The existence of two critical network-reachable vulnerabilities in the same management product increases the urgency of applying the full vendor update rather than attempting to mitigate one CVE independently.
However, defenders should not claim that CVE-2026-59309 and CVE-2026-59310 are known to be chained in the observed campaign.
The Hacker News reported that scanning consistent with interest in CVE-2026-59309 had been observed, but QUIRSO said there was not enough evidence to correlate that activity with the intrusion set exploiting CVE-2026-59310. (द हैकर न्यूज़)
That distinction matters for accurate threat reporting.
How to Detect Possible CVE-2026-59310 Compromise
Once active exploitation has been confirmed, patch management and threat hunting become two separate jobs.
Patching prevents future exploitation through the vulnerability.
It does not automatically remove persistence created before patching.
Organizations that operated an affected vCenter during the exploitation window should therefore consider retrospective hunting.
Review Unexpected Persistence
QUIRSO’s reported intrusion involved a malicious cron job used to maintain reverse SSH persistence. (द हैकर न्यूज़)
Security teams should investigate unexpected modifications to persistence mechanisms on the vCenter appliance, particularly changes that cannot be tied to legitimate upgrades, administrative maintenance, monitoring software, backup software, or approved automation.
The objective is not to search for one hard-coded filename.
It is to identify unauthorized persistent execution.
Search for reverse_ssh
QUIRSO’s public YARA rule detects characteristic strings and source artifacts associated with standard NHAS reverse_ssh client builds. (गिटहब)
Its own rule warns:
dual-use tool signature
so detection should be correlated with process history, parent processes, creation timestamps, persistence, network activity, user activity, and the known vCenter exposure window.
Review Outbound Network Connections
A management appliance initiating a persistent SSH-like or otherwise unexplained outbound connection to unfamiliar external infrastructure deserves investigation.
The reported campaign used reverse SSH specifically because an outbound connection can provide continued remote access to the attacker. (ब्लिपिंगकंप्यूटर)
This is also a broader architectural lesson.
Infrastructure management systems typically need much less unrestricted Internet egress than ordinary employee endpoints.
Outbound allowlisting and management-network segmentation can therefore reduce post-exploitation freedom even when they cannot replace vulnerability patching.
Establish an Exposure Window
Defenders should reconstruct the period during which each vCenter instance was both:
vulnerable, and
reachable from potentially hostile network locations.
For example:
July 29 August 3 Patch Time
│ │ │
Disclosure Observed campaign │
│ activity begins │
└──────────────┴──────────────────────────────┘
Hunt Window
QUIRSO reported first observed victim communications on August 3, but that should not be interpreted as proof that exploitation could not have occurred earlier. (ब्लिपिंगकंप्यूटर)
The safer forensic approach is to investigate from a point before public disclosure or from the earliest credible exposure date available to your organization.
Do Not Stop at “We Patched It”
This is perhaps the most important operational lesson from CVE-2026-59310.
Suppose an attacker exploited an organization on August 4:
Organizations sometimes delay management-plane updates because they are concerned that patching vCenter will stop production workloads.
Broadcom’s FAQ states that updating vCenter does नहीं stop running virtual machine and container workloads simply because vCenter itself is unavailable during the update.
Administrators temporarily lose access to the vSphere Client and other vCenter-dependent management capabilities, but workloads continue running. (Bitly)
This is distinct from patching ESXi itself, which may require host restart depending on the update mechanism.
For CVE-2026-59310 specifically, Broadcom also notes that these vCenter updates are not eligible for vCenter Quick Patch, meaning administrators need to use conventional vCenter patching or an applicable Reduced Downtime Upgrade method. (Bitly)
Given confirmed active exploitation and the absence of a workaround, postponing the update simply because a vCenter maintenance window is inconvenient should be reconsidered against the security risk.
Broadcom Calls This an Emergency Change
Broadcom’s supplemental FAQ is unusually direct about prioritization.
It says the vulnerabilities covered by VMSA-2026-0006 qualify under ITIL methodologies as an emergency change and require prompt organizational action. It instructs customers to install one of the fixed versions from the security advisory. (Bitly)
That recommendation was written before the latest public evidence of successful exploitation became widely reported.
The active exploitation evidence only strengthens the case for urgent remediation.
There Is No Official Workaround
Broadcom explicitly states that no workaround exists for CVE-2026-59310. (Support Portal)
The supplemental FAQ acknowledges that organizations may have compensating controls such as perimeter firewalls, appliance firewalls, network restrictions, and defense-in-depth controls, but does not treat these as substitutes for updating the affected software. (Bitly)
This distinction is important for vulnerability management systems.
The status:
vCenter not Internet exposed
should not automatically become:
CVE mitigated
A threat actor who compromises another system with access to the management plane could still potentially reach the vulnerable service.
A better status is:
Exposure reduced by network controls
Patch still required
Network Segmentation Still Matters
Although segmentation does not replace the patch, CVE-2026-59310 is an excellent example of why virtualization management infrastructure should live behind strong network boundaries.
4. Identify Systems That Were Vulnerable During the Attack Window
Do not remove the vulnerability from the incident queue simply because today’s scan shows a patched version.
Record when the fix was installed and determine how long the previous vulnerable instance had been reachable.
5. Hunt for Persistence
Examine unexpected persistence, including cron-based persistence consistent with the activity described by QUIRSO. (द हैकर न्यूज़)
6. Hunt for reverse_ssh
Use endpoint and filesystem telemetry where available and consider QUIRSO’s generic detection logic, while remembering that reverse_ssh itself is dual use. (गिटहब)
7. Examine Outbound Connections
Look for unexplained external connections originating from vCenter, especially persistent connections to infrastructure that has no documented operational purpose.
8. Investigate Administrative Changes
If compromise is suspected, review security-relevant configuration changes, account activity, permissions, certificates, integrations, and management operations during the suspected intrusion window.
9. Expand the Investigation When Evidence Supports It
Because vCenter occupies a central infrastructure-management position, confirmed compromise should prompt an assessment of whether the attacker moved beyond the appliance.
The investigation should be evidence driven rather than assuming either that the attacker definitely moved laterally or that the incident remained contained.
Safe Validation Is Better Than Blind Exploitation
The appearance of a critical vulnerability often creates pressure to download the first public proof of concept and execute it against production.
That is unnecessary for basic CVE-2026-59310 exposure assessment.
The core facts are already enough:
Product = affected vCenter
AND
Version < fixed release
AND
Service reachable
That system should be treated as vulnerable.
A controlled security-validation workflow can instead use:
If exploit validation is genuinely required for security research, red teaming, or assurance, it should be performed only against explicitly authorized infrastructure and should capture enough evidence to distinguish vulnerability verification from destructive exploitation.
For an actively exploited management-plane RCE, the priority is reducing exposure—not proving an already vulnerable production server can be compromised.
Why CVE-2026-59310 Matters Beyond VMware
CVE-2026-59310 demonstrates a recurring problem in enterprise security: the systems used to manage other systems become unusually valuable attack targets.
Security programs sometimes concentrate controls on workloads:
Web applications
Endpoints
Databases
Servers
Cloud workloads
while implicitly trusting management infrastructure:
A management system can provide more strategic leverage than an individual workload.
The rapid exploitation reported after the July 29 disclosure also illustrates how quickly the gap between patch availability and attacker activity can shrink. QUIRSO’s observed systems began contacting attacker infrastructure on August 3, only five days after disclosure. (ब्लिपिंगकंप्यूटर)
For high-impact, remotely exploitable infrastructure vulnerabilities, traditional monthly patch cycles may simply be too slow.
CVE-2026-59310 Detection, Patching, and Compromise Validation Workflow
Is CVE-2026-59310 a remote code execution vulnerability?
Yes. Broadcom states that a malicious actor with network access to vulnerable VMware vCenter may exploit the directory traversal vulnerability to execute arbitrary code. (Support Portal)
Does CVE-2026-59310 require authentication?
The CVSS vector specifies PR:N, and Rapid7 describes the vulnerability as exploitable by an unauthenticated attacker with network access to the vulnerable vCenter server. (National Vulnerability Database)
Yes, active exploitation has now been reported. NHS England states that researchers observed successful exploitation involving reverse SSH persistence, while QUIRSO’s incident-response investigation linked compromised vCenter systems to activity consistent with CVE-2026-59310. (एनएचएस इंग्लैंड डिजिटल)
When did active attacks begin?
QUIRSO reported observing compromised systems first contacting attacker-controlled infrastructure on August 3, 2026. This is the earliest date reported in that dataset and should not be interpreted as proof that no earlier exploitation occurred. (ब्लिपिंगकंप्यूटर)
How many systems have been compromised?
QUIRSO reported identifying 361 victim IP addresses across 47 countries by August 7. This represents the researchers’ observed dataset, not a definitive global victim count. (ब्लिपिंगकंप्यूटर)
What persistence mechanism have attackers used?
The reported campaign deployed the open-source reverse_ssh framework and used persistence including a malicious cron job. (द हैकर न्यूज़)
Does detecting reverse_ssh prove compromise?
No. reverse_ssh is dual use. QUIRSO’s published YARA rule specifically warns that a match identifies the tool but maliciousness must be determined from deployment context and telemetry. (गिटहब)
Is there a workaround?
No official workaround is available. Broadcom instructs customers to install fixed versions. (Support Portal)
What vCenter versions fix CVE-2026-59310?
For the primary supported branches, Broadcom lists vCenter 9.1.0.0300, 9.0.2.0100, 8.0 U3k, और 8.0 U2f, with branch-specific instructions for VMware Cloud Foundation and Telco products. (Support Portal)
Should I hunt for compromise after patching?
Organizations that operated vulnerable and reachable vCenter instances during the observed exploitation period should strongly consider retrospective investigation. The patch closes the vulnerability, but successful attackers may already have established independent persistence such as the reverse SSH mechanism observed in the current campaign. (ब्लिपिंगकंप्यूटर)
Final Assessment
CVE-2026-59310 deserves emergency treatment because several high-risk conditions exist simultaneously.
It affects VMware vCenter, a highly privileged infrastructure management system. It is remotely reachable over the network, requires no prior privileges or user interaction according to VMware’s CVSS assessment, carries a 9.8 Critical score, leads to arbitrary code execution, has no official workaround, and now has credible evidence of successful exploitation. (National Vulnerability Database)
The observed post-exploitation behavior raises the stakes further. Incident responders found attackers deploying reverse SSH persistence and establishing outbound connectivity from compromised systems. QUIRSO’s reported telemetry showed victim communications beginning within five days of public disclosure. (ब्लिपिंगकंप्यूटर)
For defenders, the correct response is therefore not merely:
patch CVE-2026-59310.
It is:
identify vulnerable vCenter systems, patch them immediately, determine how long they were exposed, hunt for persistence and unexpected outbound activity, investigate evidence of compromise, and only close the incident when both vulnerability remediation and retrospective validation are complete.
CVE-2026-59310 is another reminder that once a critical vulnerability reaches an enterprise management plane, the time between disclosure and operational exploitation may be measured in days—not in the length of a normal patch cycle. (ब्लिपिंगकंप्यूटर)
CVE-2022-42889, commonly called Text4Shell, is a critical vulnerability associated with Apache Commons Text’s string interpolation functionality. It became particularly notable
Hindi 
English 
German 
French 
Spanish 
Portuguese 
Japanese 
Korean 
Arabic 
Turkish 
Hebrew