Reported by 4 outlets

Timeline

1. original reporting

   Hackers Exploit Critical VMware vCenter Flaw to Deploy Reverse SSH Across 47 Countries

   gbhackers.com · 62d ago · August 12th, 2026

   Threat researchers have identified an active campaign exploiting the critical VMware vCenter vulnerability CVE-2026-59310, with 361 victim IP addresses observed across 47 countries. This campaign reportedly began within days of the public disclosure and employs reverse SSH tooling to maintain remote access to compromised infrastructure. Critical vCenter Exposure CVE-2026-59310 is a directory-traversal flaw in VMware […] The post Hackers Exploit Critical VMware vCenter Flaw to Deploy Reverse SSH Across 47 Countries appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

2. update from cyberpress.org

   Critical VMware vCenter Directory Traversal Flaw Used in Global Attacks

   cyberpress.org · 62d ago · August 12th, 2026

   Broadcom VMware vCenter administrators are facing an intrusion campaign targeting CVE-2026-59310 , a critical directory-traversal vulnerability in the vCenter Syslog Server. Threat researchers at QUIRSO said they identified 361 unique victim IP addresses across 47 countries, with evidence suggesting a suspected advanced persistent threat is using the flaw to obtain code execution and establish remote access. The campaign shows attackers rapidly operationalizing weaknesses in exposed virtualization-management infrastructure. Broadcom issued advisory VMSA-2026-0006 on July 29, 2026. Critical VMware vCenter Directory Traversal Flaw QUIRSO observed affected systems begin connecting to attacker-controlled infrastructure on August 3 five calendar days later. Activity then accelerated: 151 additional victim IPs appeared on August 4, and 343 of the 361 observed addresses, roughly 95%, had been seen by August 5. CVE-2026-59310 carries a CVSS v3.1 score of 9.8. The issue is a path-traversal flaw in vCenter’s Syslog Server that a network-reachable attacker can exploit to execute arbitrary code. Its risk is amplified by vCenter’s role as the management plane for virtualized environments; a compromise can give an intruder a foothold from which to target hosted workloads, credentials, or administrative operations. Victim telemetry shows a geographically broad exposure pattern. Germany, the United States, Turkey, Iran and France were the five most affected countries, collectively accounting

3. mentioned by securityweek.com

   Critical VMware vCenter Vulnerability in Attackers’ Crosshairs

   securityweek.com · 61d ago · August 13th, 2026

4. update from bleepingcomputer.com

   Critical VMware vCenter RCE flaw exploited for reverse SSH access

   bleepingcomputer.com · 61d ago · August 13th, 2026

   The vendor provides no workarounds or mitigations and urges system administrators to apply the emergency update and consult the FAQ post for additional information. The following vCenter releases address the security issue: vCenter 9.1: 9.1.0.0300 vCenter 9.0: 9.0.2.0100 vCenter 8.0: 8.0 U3k or 8.0 U2f, depending on the branch VMware vCenter is a centralized management software for controlling, monitoring, and configuring an organization’s VMware virtual infrastructure, including virtual machines, ESXi servers, configurations, and access permissions. The product is a frequent target for its broad control over multiple critical systems. Attackers can use this access for data theft and operational disruptions. According to digital forensics and incident response (DFIR) company QUIRSO, compromised systems started to connect to attacker-controlled infrastructure on August 3, just five days after Broadcom disc