Widespread Scanning for VMware vCenter Flaws (CVE-2026-59309)
Hackers Mass-Scanning for Critical VMware vCenter Flaws
Related Entities(initial)
Organizations
Products & Tech
CVE Identifiers
Full Report(when first published)
Executive Summary
Following a critical security advisory from Broadcom in late July 2026, security researchers are observing widespread, automated scanning activity targeting VMware vCenter Server instances. The scans are aimed at identifying systems vulnerable to several critical flaws, most notably CVE-2026-59309, a CVSS 9.8 authentication bypass. This fingerprinting activity is a strong precursor to mass exploitation. Meanwhile, a separate critical vulnerability from the same advisory, CVE-2026-59310 (CVSS 9.8), is already confirmed to be under active exploitation in the wild to establish persistent remote access on compromised systems. Administrators are urged to patch their vSphere environments immediately and ensure management interfaces are not exposed to the internet.
Vulnerability Details
The VMSA-2026-0006 advisory detailed several flaws, with three being of critical concern:
CVE-2026-59309: Authentication Bypass in vmdir (CVSS 9.8)
- A flaw in the VMware Directory Service (vmdir) allows a remote attacker with network access to the vCenter Server to bypass authentication mechanisms. Successful exploitation grants unauthorized access to the vCenter environment, potentially allowing full control over the virtual infrastructure.
CVE-2026-59310: Directory Traversal in Syslog Server (CVSS 9.8)
- A directory traversal vulnerability in the vCenter Syslog Server can be exploited to achieve arbitrary code execution. This flaw is being actively exploited.
CVE-2026-47876: Out-of-Bounds Write in VMXNET3 (CVSS 9.3)
- A flaw in the VMXNET3 virtual network adapter could allow a malicious guest virtual machine to execute code on the underlying ESXi host, escaping the VM.
Affected Systems
- VMware vCenter Server: Versions prior to the patches released in VMSA-2026-0006.
- VMware ESXi: Versions prior to the patches, specifically concerning CVE-2026-47876.
- Other products including Workstation, Fusion, Cloud Foundation, and vSphere Foundation are also affected by various flaws in the advisory.
Exploitation Status
- Widespread Scanning: Honeypots and security researchers have detected a significant increase in scanning and fingerprinting activity targeting vCenter servers. Attackers are probing endpoints like
/sdk/and/webssoto identify vulnerable instances of CVE-2026-59309. - Active Exploitation: German cybersecurity firm QUIRSO confirmed that CVE-2026-59310 is being actively exploited. Attackers are using the path traversal flaw to write a malicious
cronjob, which then establishes a persistent reverse SSH tunnel using thereverse_sshtool. This campaign has already compromised over 360 unique IP addresses globally.
Impact Assessment
Compromise of a vCenter Server is a worst-case scenario for most organizations. It grants an attacker centralized control over the entire virtualized environment. An attacker could exfiltrate, modify, or destroy virtual machines and their data; deploy ransomware across the entire estate; or use the hypervisor as a persistent and hard-to-detect launchpad for further attacks within the network. The active scanning indicates that automated, widespread attacks are likely imminent, potentially leading to a wave of breaches and ransomware incidents similar to past events involving critical flaws in virtualization management platforms.
Cyber Observables — Hunting Hints
The following patterns may help identify vulnerable or compromised systems:
/sdk//webssoreverse_sshcronOutbound SSHDetection Methods
- Log Analysis (D3-NTA): Analyze vCenter and web proxy logs for a high volume of requests to the
/sdk/and/webssoendpoints from single IP addresses, which can indicate scanning. - File Integrity Monitoring: On vCenter appliances, monitor for the creation of new files in system directories, particularly in cron-related paths like
/etc/cron.d/. Alert on the appearance of unexpected binaries likereverse_ssh. - Network Monitoring: Implement firewall rules to alert on or block any outbound SSH traffic originating from the vCenter Server's management interface. This is a high-fidelity indicator of the known exploit chain for CVE-2026-59310.
Remediation Steps
- Patch Immediately (D3-SU): The top priority is to apply the patches released by Broadcom in the VMSA-2026-0006 advisory to all vCenter and ESXi hosts.
- Isolate Management Interfaces (D3-NI): Ensure that vCenter Server management interfaces are not exposed to the public internet. Access should be restricted to a secure management network, accessible only via VPN or a bastion host.
- Hunt for Compromise: Proactively hunt for the indicators of compromise listed above. If any are found, assume the system is compromised and activate the organization's incident response plan. This should include rotating all credentials associated with vCenter (including service accounts and admin users) and analyzing virtual machines for signs of tampering.
Timeline of Events
Article Updates
August 13, 2026
APT group actively exploiting CVE-2026-59310 in VMware vCenter, compromising 361 systems across 47 countries just five days post-patch.
Update Sources:
MITRE ATT&CK Mitigations
Update Software
Apply the patches from VMSA-2026-0006 to all affected VMware products.
Mapped D3FEND Techniques:
Do not expose vCenter management interfaces to the internet. Restrict access to a secure, internal management network.
Mapped D3FEND Techniques:
Filter Network Traffic
Use firewalls to block anomalous outbound traffic, such as SSH from a vCenter appliance.
Mapped D3FEND Techniques:
D3FEND Defensive Countermeasures
The most urgent action is to apply the security patches detailed in Broadcom's VMSA-2026-0006 advisory. Given the active exploitation of CVE-2026-59310 and widespread scanning for CVE-2026-59309, patching cannot be delayed. This should be treated as an emergency change. Prioritize all internet-facing or otherwise exposed vCenter Server instances. Use vSphere Lifecycle Manager to streamline the update process across your ESXi hosts and vCenter. Verifying the patch level of all components post-update is crucial to ensure the vulnerabilities are fully remediated.
Immediately audit the network exposure of all vCenter Server management interfaces. Under no circumstances should these interfaces be accessible from the public internet. Implement strict firewall rules to ensure vCenter is only accessible from a segregated, secure management network (a 'management VLAN'). Access to this management network should require connecting through a bastion host or a VPN with multi-factor authentication. This single control dramatically reduces the attack surface and would have prevented both the scanning and the exploitation attempts described.
As a critical defense-in-depth measure, implement egress filtering on the network segment containing your vCenter Server. A vCenter appliance has no legitimate reason to initiate an outbound SSH connection to the internet. Create a default-deny firewall rule for outbound traffic from the vCenter appliance, only allowing specific, required connections (e.g., to NTP servers, VMware update servers). A specific rule to block outbound TCP port 22 (SSH) would have defeated the persistence mechanism used in the active exploitation of CVE-2026-59310. This control helps contain a compromised system and provides a high-fidelity alert if an attacker attempts to establish a C2 channel.
Timeline of Events
Broadcom releases VMSA-2026-0006 security advisory.
Systems compromised via CVE-2026-59310 begin communicating with attacker infrastructure.
Widespread scanning activity for vCenter vulnerabilities is reported by researchers.
Sources & References(when first published)
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.