Introduction

In a series of recent cybersecurity disclosures, a critical vulnerability in VMware vCenter Server has emerged as a top priority for security administrators worldwide. Identified as CVE-2026-59310, this directory traversal vulnerability carries a near-perfect CVSS score of 9.8. More alarmingly, security researchers have confirmed that threat actors, including those with suspected nation-state affiliations, are already actively exploiting this flaw to deploy ransomware and establish persistent backdoors within enterprise environments.

What is CVE-2026-59310?

CVE-2026-59310 is a directory traversal vulnerability located within the Syslog service of VMware vCenter Server. Directory traversal (also known as path traversal) is a type of security exploit that allows an attacker to access files and directories that are stored outside the intended folder. In this specific case, an unauthenticated attacker with network access to a vCenter instance can leverage the flaw to read or even write arbitrary files on the underlying filesystem.

The ability to write arbitrary files to a system management server like vCenter almost inevitably leads to Remote Code Execution (RCE). By placing malicious scripts or modifying configuration files, an attacker can gain full control over the vCenter Server, which serves as the central management hub for an entire virtualized infrastructure.

Affected Systems and Software

The vulnerability impacts various versions of VMware vCenter Server and VMware Cloud Foundation. According to the security advisory VMSA-2026-0006 from Broadcom, the following product versions are affected:

• VMware vCenter Server 8.0: All versions prior to 8.0 U3k.
• VMware vCenter Server 7.0: (Check vendor advisories for specific end-of-life status and backported patches).
• VMware Cloud Foundation: Versions 4.x and 5.x.
• vSphere Foundation: Legacy deployments utilizing vCenter management.

It is important to note that any organization relying on VMware’s virtualization stack for their private or hybrid cloud likely has a vCenter instance that requires immediate attention.

Severity and Potential Impact

With a CVSS v3.1 score of 9.8 (Critical), the impact of CVE-2026-59310 cannot be overstated. Because vCenter Server manages the ESXI hosts, virtual machines, and storage across a data center, a compromise at this level gives an attacker “the keys to the kingdom.”

Reports from the field indicate that a China-nexus threat actor has been observed exploiting this vulnerability as early as August 3, 2026. These attackers have been seen deploying a reverse_ssh tool, which allows them to bypass traditional inbound firewall rules by establishing an outbound connection to an attacker-controlled server. Once established, this access has been used to deploy Babuk-derived ransomware, effectively paralyzing the victim’s entire virtual infrastructure by encrypting virtual machine disks (VMDKs) and backups.

Mitigation and Patching Steps

There are currently no known workarounds for CVE-2026-59310. The only way to fully mitigate the risk is to apply the security updates provided by Broadcom/VMware. The primary recommendation is to upgrade vCenter Server to the following fixed versions:

• VMware vCenter Server 8.0: Update to 8.0 U3k or later.
• VMware Cloud Foundation (VCF) 9: Update to versions 9.1.0.0300 or 9.0.2.0100.

In addition to patching, security teams should implement the following defensive measures:

• Network Segmentation: Ensure that vCenter management interfaces are placed on a dedicated, isolated management network. These interfaces should never be exposed to the public internet.
• Access Control Lists (ACLs): Restrict access to the vCenter Syslog and management ports to only authorized administrative IP addresses.
• Indicator Search: Audit system logs for the presence of the reverse_ssh payload or unusual outbound network activity to unexpected IP addresses.
• Verification: Use the VMware Software Checker or similar tools to verify that the patch has been correctly applied and that no unauthorized files have been left behind.

Conclusion

CVE-2026-59310 represents a significant threat to modern enterprise infrastructure. The combination of its critical severity, ease of exploitation, and confirmed use by ransomware gangs makes it a “patch now” event for any organization using VMware. As attackers continue to target core infrastructure components, maintaining a robust vulnerability management program and adhering to the principle of least privilege for management networks remains the best local defense.