VMware vCenter CVE-2026-59310 Under Active Global Attack Campaign

The critical directory traversal vulnerability CVE-2026-59310 (CVSS 9.8) in Broadcom VMware vCenter Server is being actively exploited in a large-scale campaign that, according to German company QUIRSO, has affected 361 unique victim IP addresses in 47 countries. The vulnerability allows arbitrary code execution with root privileges on vCenter Server Appliance without prior authentication. Broadcom released a patch on July 29, 2026, but exploitation began just five days after public disclosure. All organizations using VMware vCenter must immediately apply the patch and examine their systems for signs of compromise.

Technical details of the vulnerabilities

According to NVD, CVE-2026-59310 is a directory traversal vulnerability in VMware vCenter Server. Exploitation grants an attacker immediate code execution in the root context on vCenter Server Appliance—without the need to compromise an unprivileged account and then escalate privileges. All commands recorded via the cron daemon were already executed with superuser rights.

In parallel, exploitation of CVE-2026-59309—an authentication bypass vulnerability in vCenter, which is also under active scanning—was observed on one of the compromised systems. Traces of CVE-2026-59309 exploitation are dated August 1, 2026, and include the creation of an administrative account without any login events being recorded for a legitimate account. At the same time, according to QUIRSO, activity related to the two vulnerabilities on the same system did not overlap—the account “vcenter_admin” created via CVE-2026-59309 was not used in subsequent attack phases.

Affected products include VMware vCenter Server, vCenter Server Appliance, VMware Cloud Foundation (including version 9.0), and ESXi hosts.

Attack mechanism and tooling

According to QUIRSO’s research, the CVE-2026-59310 exploitation chain began with abuse of the remote syslog mechanism in vCenter Server Appliance to place files in the /etc/cron.d directory—a privileged location for automatic execution. The first recorded artifact was a malformed cron file zz-poc59310-syslog.log, whose name explicitly references the CVE identifier and points to origin from a public proof-of-concept.

Next, the linuxFile backdoor (also known as systemlog or linux_x86) was downloaded via curl or wget commands. This implant provides remote command execution over a WebSocket channel: it connects to a control server, receives instructions, executes them via /bin/sh, and sends the results back. The C2 server address is obfuscated using XOR and decoded at runtime. Despite using unencrypted ws:// transport, communications are protected with custom application-layer cryptography. The implant supports automatic reconnection and persistence via systemd and cron.

Persistence and lateral movement

The attackers created three cron jobs masquerading as legitimate VMware services:

• vmware-vpxd-stats-* — adds the attacker’s SSH key to the authorized_keys file for remote access
• vmware-perf-collect-* — deploys the JSP web shell vmware-perf-update.jsp
• vmware-perf-sync-* — deploys the same web shell and executes a Base64-encoded script to steal credentials and create an “adminuser” account, adding it to the vSphere SSO Administrators group

For credential theft, the script /tmp/.vmware-perf-upd.sh was used. It extracted vmdir passwords either via a query to the HKEY_THIS_MACHINE\services\vmdir registry key or, if that failed, via the Python vmafd module with calls to GetMachineName(), GetMachinePassword(), and GetDomainName(). The stolen credentials were used for privileged directory modifications, including adding accounts to the administrators group.

An additional file /etc/sudoers.d/vmware-perf was created, granting the perfcharts service account unrestricted passwordless sudo access to root. On ESXi hosts, local accounts (for example, “adminuser”) were created and later used to deploy ransomware.

Final stage: ransomware as a smokescreen

The attack concluded with deployment of ransomware with the .babyk extension on ESXi hosts, characteristic of a family derived from Babuk. However, in QUIRSO’s assessment, ransomware deployment was likely not the primary objective of the campaign. Researchers view it as a smokescreen intended to distract defenders and destroy ESXi logs through encryption, depriving analysts of telemetry for incident investigation. QUIRSO’s analysis was limited to a single compromised system, so the extent of ransomware deployment across other victims remains unknown.

Threat context and attribution

QUIRSO assesses with moderate confidence that the campaign is being conducted by a Chinese-speaking actor, likely operating in the UTC+08:00 time zone. This assessment is based on a combination of indirect indicators: Chinese-language artifacts in scripts, reuse of materials from Chinese security publications, use of Chinese-language management tools, victimology that excludes mainland China, and activity patterns consistent with working hours in UTC+08:00. It should be emphasized that this attribution is not confirmed by independent sources and is based on research by a single company.

Geographic distribution of victims: Germany (55), USA (41), Turkey (38), Iran (26), France (25)—the remainder spread across 42 other countries. An operational error by the attackers was that the server 5.34.176.100:5244 exposed a set of reverse SSH tools via an open AList directory listing.

Indicators of compromise

Based on the research data, the following IOCs were recorded:

• IP addresses: 146.59.252[.]178, 5.34.177[.]38, 185.144.28[.]120, 192.255.141[.]13, 5.34.176[.]100
• Domain: intel.se9ly9upbhay[.]shop
• C2 address: ws://intel.se9ly9upbhay[.]shop:8080/ws
• Ports: 9861, 3232, 8080, 5244
• On-disk artifacts:zz-poc59310-syslog.log in /etc/cron.d, vmware-perf-update.jsp, /tmp/.vmware-perf-upd.sh, /etc/sudoers.d/vmware-perf
• Accounts: vcenter_admin, adminuser, vcadmin
• User-Agent: GoodMoodle-VCFleet/1.0

Response recommendations

1. Immediately apply the patch for CVE-2026-59310 and CVE-2026-59309 released by Broadcom on July 29, 2026. If updating is not possible within the next few hours, isolate vCenter from the internet.
2. Check for IOCs: scan /etc/cron.d for unusual files, and check for the presence of vcenter_admin, adminuser, and vcadmin accounts in vSphere SSO and locally on ESXi hosts.
3. Audit sudoers: examine /etc/sudoers.d/ for the vmware-perf file or any other illegitimate configurations.
4. Check authorized_keys: ensure there are no unauthorized SSH keys in authorization files on vCenter Server Appliance.
5. Check systemd services: look for unusual units associated with binaries named systemlog or linux_x86.
6. Block network IOCs at the perimeter: the IP addresses and domain listed above.
7. Rotate credentials: change passwords for all administrative vCenter and vmdir accounts, especially if the system was exposed to the internet after July 29, 2026.

The five-day window between public disclosure of CVE-2026-59310 and the start of mass exploitation confirms that critical vulnerabilities in virtualization infrastructure components require emergency patching within hours, not days. Organizations using internet-exposed VMware vCenter should operate under the assumption of possible compromise and conduct a full audit based on the indicators provided, rather than limiting their response to installing the update.