senn-techVMware vCenter CVE-2026-59310: From Patch to Ransomware in Five Days
Five days. That was all the time between VMware's patch for CVE-2026-59310 and the start of mass exploitation. By 14 August 2026, attackers had compromised 361 vCenter servers in 47 countries with Babuk-derived ransomware. The incident is another reminder of how quickly a known patch becomes a widespread weapon when critical infrastructure is not updated fast enough.
What happened
- 2026-07-29: Broadcom releases patch and advisory VMSA-2026-0006 for vCenter.
- 2026-08-03: Exploitation begins, attributed to a China-nexus actor.
- 2026-08-14: 361 compromised vCenter servers across 47 countries documented.
- 2026-08-18: CISA adds CVE-2026-59310 to the Known Exploited Vulnerabilities (KEV) catalog.
The peak infection rate reached 151 newly compromised servers in a single day. That suggests the attacker was not selective but running a broad scanning and automation pipeline.
The vulnerability
CVE-2026-59310 affects the vCenter Syslog Server. It is a path traversal vulnerability with a CVSS score of 9.8. The critical point is that exploitation starts without authentication: an attacker can read files outside the intended path over the network and derive further access from there.
Why vCenter specifically? Because in typical VMware environments it is the central control plane. Controlling vCenter means controlling hosts, storage, networks, backups, and often permission structures. A compromise is therefore far more severe than a single-server breach.
Attack chain
The observed chain is short and efficient:
- Path traversal in the Syslog Server — unauthenticated file read.
- Malicious cron job — establishes persistence on the vCenter system.
- Reverse SSH tunnel — gives the attacker persistent, obfuscated remote access.
- Babuk ransomware — encrypts the infrastructure, derived from the leaked Babuk codebase.
The use of a Babuk derivative is typical for groups focused on rapid propagation with minimal custom development. The code has been circulating for years and can be adapted to new environments with little effort.
Spread and impact
| Metric | Value |
|---|---|
| Compromised servers | 361 |
| Affected countries | 47 |
| Patch-to-exploit window | 5 days |
| Peak new infections/day | 151 |
| CISA KEV added | 2026-08-18 |
| CVSS | 9.8 |
These numbers show not only a successful campaign but also the real-world response time of critical infrastructure. Even systems as important as vCenter are often not patched within days because the downtime and restart impact must be carefully planned.
What to do now
- Apply the patch: Implement Broadcom VMSA-2026-0006 immediately if not already done.
- Review logs: Inspect
/storage/logand syslog directories for unusual file access, cron entries, and process activity. - Validate SSH and tunnel connections: Identify suspicious reverse-SSH sessions and outbound network connections.
- Examine the surroundings: Do not limit the investigation to vCenter — check every ESXi host and VM managed through it for indicators of compromise.
- Verify backup posture: Backups must be isolated and restorable in case ransomware was deployed.
Further reading
Why was a five-day patch gap enough for mass compromise?+
vCenter is a central management target in almost every VMware environment. Controlling it gives an attacker access to ESXi hosts, virtual machines, backups, and network segments. Many operators could not patch within five days because vCenter updates require maintenance windows and reboots. That was enough time for the attacker to systematically probe thousands of exposed instances.
What makes CVE-2026-59310 technically so dangerous?+
The flaw sits in the vCenter Syslog Server. An unauthenticated path traversal allows reading files outside the intended directory. From there, the attacker gathers enough information to manipulate internal processes, install a malicious cron job, and ultimately execute code on the vCenter system. The combination of network reachability, no authentication, and deep integration explains the CVSS score of 9.8.
What concrete steps should affected teams take right now?+
Install the patch from Broadcom VMSA-2026-0006 first. In parallel, review vCenter logs for unknown cron entries, suspicious SSH connections, and anomalies in /storage/log. If compromise is suspected, every ESXi host and VM managed through vCenter must be forensically examined — not only vCenter itself.