A critical directory traversal flaw in VMware vCenter (CVE-2026–59310) is being actively exploited by a sophisticated threat actor across 47 countries. Experts warn that simple patching may not be enough to remove attackers.

Key Takeaways

  • A critical vulnerability (CVE-2026–59310) with a 9.8 CVSS score has been identified in VMware vCenter.
  • A single advanced threat actor is targeting users across 47 different nations.
  • Attackers are using 'reverse_ssh' to maintain persistence even after software patches are applied.
  • Forensic investigation is highly recommended to ensure no compromise exists.

A massive global threat campaign has emerged targeting VMware vCenter, exploiting a critical directory traversal vulnerability known as CVE-2026–59310. Disclosed by VMware on July 29, the flaw has seen intense exploitation by a suspected advanced persistent threat (APT) actor just days after its public release.

Global Reach of the Attack

According to the German incident-response firm QUIRSO, the exploitation activity has spanned 47 countries, with the highest concentration of targets in the United States, France, Iran, and Turkey. The campaign has been linked to 361 unique IP addresses, though the actual number of victims is likely much higher as many IP addresses belong to shared cloud infrastructure.

Read Also:AI Surveillance Proposed to Track Every Rupee After Ayodhya Temple Donation Heist

Why This Matters

BozokMedia analysis shows that the impact of this vulnerability is catastrophic due to the nature of vCenter. As a central management hub for virtualized environments, a successful exploit allows an attacker to execute arbitrary code, effectively granting them the 'keys to the kingdom' and control over the entire enterprise estate.

"It is essentially a race between exploitation and patching. We therefore recommend a forensic investigation of potentially affected systems to rule out an existing compromise." — Denis Szadkowski, COO of QUIRSO

Security experts warn that a standard patching cycle may be insufficient. The threat actor is reportedly utilizing reverse_ssh, an open-source tool, to establish outbound control channels. This allows the attacker to maintain a persistent presence in the environment, meaning even after the vulnerability is patched, the attacker can still access the system through these established backdoors.

Historical Background

VMware products have become high-value targets for both cybercriminal gangs and nation-state actors. Because virtualization is the backbone of modern data centers, vulnerabilities in hypervisors and management layers like vCenter offer a massive 'blast radius,' where one single breach can compromise thousands of virtual machines.

Did You Know?: Skilled attackers often use a technique called 'patch diffing' to analyze security updates immediately after they are released, allowing them to create exploits within hours of a patch becoming public.

Frequently Asked Questions

1. Is patching my VMware software enough to stay safe?
Not necessarily. If the attacker has already used 'reverse_ssh' to create a backdoor, they will remain in your system even after the patch is applied.

2. What should organizations do immediately?
Organizations should perform a deep forensic audit of their vCenter instances and implement strict network micro-segmentation to limit outbound connectivity.