CTI · reported · 2026-08-19

Critical VMware vCenter Directory Traversal Flaw Used in Global Attacks

Full story & timeline

MITRE ATT&CK

• T1190 Exploit Public-Facing Application Initial Access
• T1059 Command and Scripting Interpreter Execution
• T1105 Ingress Tool Transfer Command and Control
• T1572 Protocol Tunneling Command and Control

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: VMware vCenter Path Traversal Exploitation - CVE-2026-59310
id: a1c7e3d2-84b1-4f9a-b6e2-3d8f5a9c1b4e
status: experimental
description: Detects path traversal exploitation attempts targeting the VMware vCenter Syslog Server component (CVE-2026-59310). Attackers use directory traversal to achieve arbitrary code execution on vCenter deployments.
references:
  - https://gbhackers.com/cisa-warns-vmware-vcenter-path-traversal-flaw/
  - https://cyberpress.org/vmware-vcenter-path-traversal-flaw-exploited/
author: Tia N. List
date: 2026-08-19
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - '..\\'
      - '..\/'
      - '%2e%2e%5c'
      - '%2e%2e%2f'
  filter_syslog:
    ParentImage|contains: 'vmware-vpxd'
  condition: selection and not filter_syslog
falsepositives:
  - Legitimate administrative scripts performing directory traversal checks
  - VMware diagnostic tools that reference parent directories
level: high

References

• https://gbhackers.com/cisa-warns-vmware-vcenter-path-traversal-flaw/
• https://cyberpress.org/vmware-vcenter-path-traversal-flaw-exploited/