CISA Flags vCenter Flaw CVE-2026-59310 for Ransomware as Babuk Hits ESXi Hosts

A critical flaw in VMware vCenter that was patched in late July has crossed from espionage into ransomware. CISA's Known Exploited Vulnerabilities catalog now marks CVE-2026-59310 as used in ransomware campaigns, and reporting on 15 September confirmed that extortion crews have joined the suspected nation-state actor already abusing the bug. The technical facts have not changed since Broadcom shipped the fix. What changed is who is holding the exploitExploit🛡️Code or technique that takes advantage of a vulnerability to cause unintended behavior, such as gaining unauthorized access. and what they do once inside.

If you run vCenter and have not patched, treat this as an active incident and not a maintenance item. The vulnerabilityVulnerability🛡️A weakness in software, hardware, or processes that can be exploited by attackers to gain unauthorized access or cause harm. is unauthenticated, network-reachable, and scored CVSS 9.8. The path from a single request to encrypted virtual machines is now well documented.

What Happened

Broadcom disclosed CVE-2026-59310 on 29 July 2026 in advisory VMSA-2026-0006, alongside a second maximum-severity vCenter bug, CVE-2026-59309, an authentication bypassAuthentication Bypass📖A security vulnerability that allows an attacker to circumvent the login verification process and gain unauthorized access to a system without providing valid credentials. in the VMware Directory Service. Both carry a CVSS base score of 9.8 with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and both were credited to Phil Brass and Matt South of Atredis Partners. The advisory was revised twice, adding express patches for the 8.0 branch on 3 August and guidance for extended-support 7.0 installations on 19 August. There is no workaround for either flaw.

CVE-2026-59310 is a directory traversal weakness (CWE-22) in the vCenter Syslog server. An attacker who can reach the service over the network can write files outside the intended directory, and that write primitive is enough to reach arbitrary code execution on the appliance. At the time of disclosure, Broadcom's own FAQ said it had no information to suggest exploitation had occurred. That stance predates the exploitation reports that followed.

CISA added the vulnerability to the KEV catalog on 18 August with a three-day remediation deadline of 21 August under Binding Operational Directive 26-04, and flagged it for forensic triageForensic Triage🛡️A rapid, structured assessment of whether a system was compromised, performed alongside patching rather than after it. It prioritizes evidence the attacker could not have altered, such as network egress and authentication logs on other systems, over the affected host's own logs.. Over the weekend of 13 to 14 September the catalog entry was updated to record known ransomware use, the development that drove this week's coverage.

Who Is Affected

The flaw affects vCenter Server 8.0, 9.0.x, and 9.1.x, along with the VMware Cloud Foundation and vSphere Foundation bundles that ship vCenter, plus Telco Cloud products. Fixed builds are vCenter 9.1.0.0300, 9.0.2.0100, and 8.0 U3k, with an 8.0 U2f express patch for that branch. vSphere 7.0 reached end of general support in October 2025, so 7.0 fixes require an extended-support contract through Broadcom.

Incident responders at QUIRSO, whose analysis was relayed by The Hacker News, BleepingComputer, and others, mapped a global campaign of 361 unique victim IP addresses across 47 countries. Germany, the United States, Turkey, Iran, and France accounted for roughly half. The tempo was brutal: the first compromised systems contacted attacker infrastructure on 3 August, five days after the patch, and by 5 August about 95 percent of the eventual victims were already tagged. Any vCenter that was internet-reachable and unpatched in early August should be considered a candidate for compromise regardless of its patch status today.

How the Attack Works

The published attack chain is a clean escalation from one network write to a whole virtual estate, and it is worth understanding because it dictates the response. According to QUIRSO's analysis as reported by secondary outlets, exploitation of the syslog traversal writes a malformed cron file into the appliance's cron directory. The cron daemon runs it as root, so an unauthenticated request becomes root execution with no matching authentication event in the logs. That gap between "commands ran as root" and "nobody logged in" is the tell.

From root, the actor harvests the vCenter machine accountMachine Account🛡️An Active Directory account that represents a computer or service rather than a person. Machine accounts often hold broad privileges, which makes them high-value targets for relay attacks. credentials from the directory service and forges a SAML token for the built-in administrator@vsphere.local identity, a golden SAMLGolden SAML🛡️An attack in which an adversary who has obtained the signing key or credentials of an identity provider forges valid SAML authentication tokens for any user, including administrators. Because the tokens are correctly signed, downstream services trust them without a further password check. style abuse of single sign-on. That token is trusted across the vSphere estate, so the attacker pivots from the management appliance to the ESXiESXi🌐VMware's bare-metal hypervisor, installed directly on server hardware to run virtual machines. Each ESXi host is administered through vCenter, and its management interface controls the host's accounts, storage, and the workloads it runs, which makes that interface high-value attack surface. hosts it governs, creates local administrator accounts on those hosts, and stages a reverse SSH tunnel for persistent outbound control that evades inbound firewallFirewall🌐Security system that monitors and controls network traffic based on predetermined rules. rules. The mechanics of that channel are the subject of our guide Detecting Reverse-Tunnel Implants: Finding C2 Hidden in Ordinary Traffic.

The final stage is Babuk-derived ransomware executed directly on the hypervisors. Helper scripts stop running virtual machines, encrypt the .vmdk and .vmx files on VMFS datastores with a .babyk extension, and strip the vSphere high-availability agent. QUIRSO assesses the operator as a suspected China-nexus group at moderate confidence, based on Chinese-language artifacts and working hours, and suggests the encryptionEncryption🛡️The process of converting data into a coded format that can only be read with the correct decryption key. may partly serve to destroy evidence. This is exactly why we argue in a companion piece that ransomware operators encrypt at the hypervisorHypervisor🌐Software that creates and manages virtual machines by allocating physical hardware resources among multiple guest operating systems. VMware ESXi is a Type 1 (bare-metal) hypervisor. instead of the guest: one host holds many VMs, and the management planeManagement Plane🌐The interfaces and services used to configure and administer a device, as distinct from the data plane that carries user traffic. On a remote-access appliance the management plane is the admin console; exposing it to the internet or to the user-facing portal is a common root cause of privileged compromise. is the shortest route to all of them, a point we develop in Why Compromising vCenter Hands Over Every VM It Manages.

Immediate Actions

Patch first. Move every vCenter to 9.1.0.0300, 9.0.2.0100, or 8.0 U3k, and remediate CVE-2026-59309 in the same maintenance window since both are fixed together and both are unauthenticated. Where you cannot patch immediately, restrict network reachability to the management plane as tightly as you can.

Then assume the patch is only half the job. A system compromised in early August is still compromised after you update it. Hunt for the documented artifacts: cron entries that impersonate VMware performance tasks, unexpected local accounts on ESXi hosts, injected SSH authorized keys, and outbound SSH or WebSocket connections from appliances that should never initiate them. Because the attacker held root and forged SSO tokens, rotate the vCenter machine credentials and vSphere SSO secrets, and treat every credential the appliance could reach as suspect, the discipline we lay out in After a Firewall Breach, Assume Every Stored Credential Is Compromised. If you find ESXi encryption, your recovery depends on backups the attacker could not reach or alter.

Long-Term Outlook

The uncomfortable lesson is speed. Five days from patch to mass exploitation leaves no room for a quarterly maintenance cycle on management infrastructure. The virtualization control plane deserves the same patch urgency and the same network isolation as any internet-facing service, and in most environments it does not get either. Segmenting vCenter and ESXi management away from general traffic, forcing administrative access through controlled hosts, and monitoring outbound connections from appliances are the controls that would have blunted this campaign. We cover that build in How to Isolate a Virtualization Management Plane from the Rest of the Network. vCenter has appeared on the KEV list repeatedly; planning around the next appearance is more useful than reacting to this one.

Sources

• Broadcom VMware Security Advisory VMSA-2026-0006.2: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017
• CISA Known Exploited Vulnerabilities catalog (JSON feed), entry for CVE-2026-59310: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
• NVD entry for CVE-2026-59310: https://nvd.nist.gov/vuln/detail/CVE-2026-59310
• Rapid7, "Critical VMware vCenter Vulnerabilities" (CVE-2026-59309, CVE-2026-59310): https://www.rapid7.com/blog/post/etr-critical-vmware-vcenter-vulnerabilities-allow-authentication-bypass-and-remote-code-execution-cve-2026-59309-cve-2026-59310/
• BleepingComputer, "CISA: Critical VMware RCE flaw now exploited by ransomware gangs" (15 September 2026): https://www.bleepingcomputer.com/news/security/cisa-critical-vmware-vcenter-rce-flaw-now-exploited-by-ransomware-gangs/
• The Hacker News, "Suspected China-Nexus Actor Exploits VMware vCenter Flaw, Deploys Babuk-Derived Ransomware": https://thehackernews.com/2026/08/suspected-china-nexus-actor-exploits.html
• SecurityWeek, "Critical VMware vCenter Vulnerability in Attackers' Crosshairs": https://www.securityweek.com/critical-vmware-vcenter-vulnerability-in-attackers-crosshairs/
• Shadowserver Foundation, CVE-2026-59310 exploitation victim special report: https://www.shadowserver.org/what-we-do/network-reporting/vmware-vcenter-cve-2026-59310-exploitation-victim-special-report/