CISA Flags vCenter Flaw CVE-2026-59310 for Ransomware as…

A critical flaw in VMware vCenter that was patched in late July has crossed from espionage into ransomware. CISA's Known Exploited Vulnerabilities catalog now marks CVE-2026-59310 as used in ransomware campaigns, and reporting on 15 September confirmed that extortion crews have joined the suspected nation-state actor already abusing the bug. The technical facts have not changed since Broadcom shipped the fix. What changed is who is holding the exploit and what they do once inside.

If you run vCenter and have not patched, treat this as an active incident and not a maintenance item. The vulnerability is unauthenticated, network-reachable, and scored CVSS 9.8. The path from a single request to encrypted virtual machines is now well documented.

What Happened

Broadcom disclosed CVE-2026-59310 on 29 July 2026 in advisory VMSA-2026-0006, alongside a second maximum-severity vCenter bug, CVE-2026-59309, an authentication bypass in the VMware Directory Service. Both carry a CVSS base score of 9.8 with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and both were credited to Phil Brass and Matt South of Atredis Partners. The advisory was revised twice, adding express patches for the 8.0 branch on 3 August and guidance for extended-support 7.0 installations on 19 August. There is no workaround for either flaw.

CVE-2026-59310 is a directory traversal weakness (CWE-22) in the vCenter Syslog server. An attacker who can reach the service over the network can write files outside the intended directory, and that write primitive is enough to reach arbitrary code execution on the appliance. At the time of disclosure, Broadcom's own FAQ said it had no information to suggest exploitation had occurred. That stance predates the exploitation reports that followed.

CISA added the vulnerability to the KEV catalog on 18 August with a three-day remediation deadline of 21 August under Binding Operational Directive 26-04, and flagged it for forensic triage. Over the weekend of 13 to 14 September the catalog entry was updated to record known ransomware use, the development that drove this week's coverage.

Who Is Affected

The flaw affects vCenter Server 8.0, 9.0.x, and 9.1.x, along with the VMware Cloud Foundation and vSphere Foundation bundles that ship vCenter, plus Telco Cloud products. Fixed builds are vCenter 9.1.0.0300, 9.0.2.0100, and 8.0 U3k, with an 8.0 U2f express patch for that branch. vSphere 7.0 reached end of general support in October 2025, so 7.0 fixes require an extended-support contract through Broadcom.

Incident responders at QUIRSO, whose analysis was relayed by The Hacker News, BleepingComputer, and others, mapped a global campaign of 361 unique victim IP addresses across 47 countries. Germany, the United States, Turkey, Iran, and France accounted for roughly half. The tempo was brutal: the first compromised systems contacted attacker infrastructure on 3 August, five days after the patch, and by 5 August about 95 percent of the eventual victims were already tagged. Any vCenter that was internet-reachable and unpatched in early August should be considered a candidate for compromise regardless of its patch status today.

How the Attack Works

The published attack chain is a clean escalation from one network write to a whole virtual estate, and it is worth understanding because it dictates the response. According to QUIRSO's analysis as reported by secondary outlets, exploitation of the syslog traversal writes a malformed cron file into the appliance's cron directory. The cron daemon runs it as root, so an unauthenticated request becomes root execution with no matching authentication event in the logs. That gap between "commands ran as root" and "nobody logged in" is the tell.

From root, the actor harvests the vCenter machine account credentials from the directory service and forges a SAML token for the built-in administrator@vsphere.local identity, a golden SAML style abuse of single sign-on. That token is trusted across the vSphere estate, so the attacker pivots from the management appliance to the ESXi hosts it governs, creates local administrator accounts on those hosts, and stages a reverse SSH tunnel for persistent outbound control that evades inbound firewall rules. The mechanics of that channel are the subject of our guide Detecting Reverse-Tunnel Implants: Finding C2 Hidden in Ordinary Traffic.

The final stage is Babuk-derived ransomware executed directly on the hypervisors. Helper scripts stop running virtual machines, encrypt the .vmdk and .vmx files on VMFS datastores with a .babyk extension, and strip the vSphere high-availability agent. QUIRSO assesses the operator as a suspected China-nexus group at moderate confidence, based on Chinese-language artifacts and working hours, and suggests the encryption may partly serve to destroy evidence. This is exactly why we argue in a companion piece that ransomware operators encrypt at the hypervisor instead of the guest: one host holds many VMs, and the management plane is the shortest route to all of them, a point we develop in Why Compromising vCenter Hands Over Every VM It Manages.

Immediate Actions

Patch first. Move every vCenter to 9.1.0.0300, 9.0.2.0100, or 8.0 U3k, and remediate CVE-2026-59309 in the same maintenance window since both are fixed together and both are unauthenticated. Where you cannot patch immediately, restrict network reachability to the management plane as tightly as you can.

Then assume the patch is only half the job. A system compromised in early August is still compromised after you update it. Hunt for the documented artifacts: cron entries that impersonate VMware performance tasks, unexpected local accounts on ESXi hosts, injected SSH authorized keys, and outbound SSH or WebSocket connections from appliances that should never initiate them. Because the attacker held root and forged SSO tokens, rotate the vCenter machine credentials and vSphere SSO secrets, and treat every credential the appliance could reach as suspect, the discipline we lay out in After a Firewall Breach, Assume Every Stored Credential Is Compromised. If you find ESXi encryption, your recovery depends on backups the attacker could not reach or alter.

Long-Term Outlook

The uncomfortable lesson is speed. Five days from patch to mass exploitation leaves no room for a quarterly maintenance cycle on management infrastructure. The virtualization control plane deserves the same patch urgency and the same network isolation as any internet-facing service, and in most environments it does not get either. Segmenting vCenter and ESXi management away from general traffic, forcing administrative access through controlled hosts, and monitoring outbound connections from appliances are the controls that would have blunted this campaign. We cover that build in How to Isolate a Virtualization Management Plane from the Rest of the Network. vCenter has appeared on the KEV list repeatedly; planning around the next appearance is more useful than reacting to this one.

Sources

Broadcom VMware Security Advisory VMSA-2026-0006.2: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017
CISA Known Exploited Vulnerabilities catalog (JSON feed), entry for CVE-2026-59310: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
NVD entry for CVE-2026-59310: https://nvd.nist.gov/vuln/detail/CVE-2026-59310
Rapid7, "Critical VMware vCenter Vulnerabilities" (CVE-2026-59309, CVE-2026-59310): https://www.rapid7.com/blog/post/etr-critical-vmware-vcenter-vulnerabilities-allow-authentication-bypass-and-remote-code-execution-cve-2026-59309-cve-2026-59310/
BleepingComputer, "CISA: Critical VMware RCE flaw now exploited by ransomware gangs" (15 September 2026): https://www.bleepingcomputer.com/news/security/cisa-critical-vmware-vcenter-rce-flaw-now-exploited-by-ransomware-gangs/
The Hacker News, "Suspected China-Nexus Actor Exploits VMware vCenter Flaw, Deploys Babuk-Derived Ransomware": https://thehackernews.com/2026/08/suspected-china-nexus-actor-exploits.html
SecurityWeek, "Critical VMware vCenter Vulnerability in Attackers' Crosshairs": https://www.securityweek.com/critical-vmware-vcenter-vulnerability-in-attackers-crosshairs/
Shadowserver Foundation, CVE-2026-59310 exploitation victim special report: https://www.shadowserver.org/what-we-do/network-reporting/vmware-vcenter-cve-2026-59310-exploitation-victim-special-report/