Security
VMware vCenter flaw exploited within five days
A critical VMware vCenter flaw was exploited within five days of disclosure across 47 countries, with attackers using reverse_ssh for persistence.
A critical VMware vCenter vulnerability disclosed on July 29, 2026, was being exploited by August 3—less than a week later—in a campaign linked to a single suspected advanced persistent threat actor. Dark Reading reports that the activity has reached 47 countries and involved 361 unique IP addresses.
The flaw, tracked as CVE-2026–59310, is a directory-traversal vulnerability rated 9.8 critical on the CVSS scale. According to VMware owner Broadcom, an attacker with network access to a vCenter instance can exploit it remotely to execute arbitrary code in the target’s virtual environment.
German incident-response company QUIRSO identified the campaign during an investigation. The United States, France, Iran, and Turkey were the most heavily targeted countries, although the 361 IP addresses do not represent a confirmed victim count because some belong to shared cloud or hosting infrastructure.
Patching may not remove the attacker
QUIRSO said the threat actor used reverse_ssh, an open-source penetration-testing tool, to establish outbound control channels from compromised systems. That creates a persistence problem: an attacker who installed the tool before the vCenter software was patched could retain access after the update.
“It is essentially a race between exploitation and patching. We therefore recommend a forensic investigation of potentially affected systems to rule out an existing compromise.”
— Denis Szadkowski, COO and co-founder of QUIRSO
QUIRSO has published a YARA rule to help organizations identify reverse_ssh builds. The campaign peaked on August 4, 2026, but Szadkowski said attacks were still active, with new victims continuing to connect to attacker-controlled infrastructure at a slower rate.
The timing suggests that public disclosure may have triggered the campaign, although QUIRSO said it could not rule out prior knowledge of the vulnerability. Szadkowski said attackers could have used patch-diffing—the analysis of changes in a security update—to develop an exploit within the five days between disclosure and the first intrusion observed by the company.
VMware customers face a particularly narrow response window because vCenter serves as a control plane for virtualized environments. Matt Snyder, principal engineer and detection and response lead at Aviatrix, said a successful attack could affect an entire estate rather than a single application.
“If a bad actor targets vCenter, the blast radius of a single unauthenticated RCE isn’t one application; it’s the whole estate.”
— Matt Snyder, principal engineer and detection and response lead, Aviatrix
Snyder recommended isolating vCenter management interfaces, applying strict network micro-segmentation, and restricting outbound connectivity to block reverse shells and other command-and-control channels. The campaign’s continuing activity means updating the software alone may not be sufficient: organizations also need to investigate systems for signs of compromise.