VMware vCenter CVE-2026-59310: Germany Hit Hardest

VMware vCenter CVE-2026-59310, a maximum-severity path-traversal vulnerability scoring 9.8 on CVSS, is being actively exploited across 47 countries — and Germany is the single most-affected country of all of them. German incident-response firm QUIRSO uncovered the campaign live during an IR engagement, tracing 361 distinct victim IP addresses back to a directory-traversal flaw in vCenter’s Syslog server that Broadcom patched on July 29.

What Happened

CVE-2026-59310 is a directory-traversal vulnerability in the VMware vCenter Syslog server, disclosed by Broadcom on July 29, 2026 (VMSA-2026-0006) with a CVSS v3.1 score of 9.8. An attacker with network access to vCenter — no prior authentication needed — can exploit the flaw to write files outside the intended directory and ultimately execute arbitrary code on the vCenter server itself. Broadcom’s advisory offers no workaround: the only fix is the emergency patch.

Exploitation began around August 3, 2026, roughly five days after public disclosure. QUIRSO’s telemetry, gathered during an active incident-response engagement, counted 361 unique victim IP addresses spread across 47 countries. Germany, the United States, Turkey, Iran and France account for the largest share of compromised hosts, with Germany at the very top of that list. The observed attack chain is consistent across victims: path-traversal exploitation of the Syslog service, followed by deployment of a malicious cron job that installs reverse_ssh, an open-source tool that opens an outbound SSH tunnel from the compromised vCenter server to attacker-controlled infrastructure. Because the connection is initiated outbound by the victim host, it survives inbound-firewall-only defenses that assume attackers must reach in rather than call out. Consistent tooling and infrastructure reuse across the 361 victims point to a single, well-resourced actor rather than opportunistic copycats.

Why It Matters

vCenter is the management plane for the hypervisor layer underneath almost every other production system a mid-market organization runs — file servers, ERP application hosts, VPN gateways, backup infrastructure, and increasingly the very SIEM and EDR tooling meant to detect an intrusion like this one. A compromised vCenter server does not just expose one workload; it exposes the administrative control point for all of them at once, including the ability to clone, export or delete virtual machine disks wholesale. For German organizations under NIS2, a hypervisor-layer compromise with confirmed unauthorized remote code execution is exactly the class of incident the regulation’s 24-hour early-warning and 72-hour incident-notification obligations were built for — and Germany’s position as the single most-affected country in QUIRSO’s own dataset removes any comfortable assumption that “this is a US problem.”

What You Should Do Now

1. Patch immediately: apply Broadcom’s VMSA-2026-0006 fix to every vCenter Server instance — there is no supported workaround or mitigation short of patching.
2. Verify: check vCenter Syslog service logs for path-traversal patterns and unexpected cron job entries; cross-reference outbound SSH connections from the vCenter host against known-good baselines, since reverse_ssh persistence depends on an outbound tunnel your egress filtering may not be watching for.
3. Mitigate in the interim: if the patch cannot be applied immediately, restrict network access to vCenter’s management interfaces to a hardened jump-host/bastion path only, and block outbound SSH from the vCenter host to anything outside a strict allow-list.
4. Monitor: hunt for the specific reverse_ssh cron persistence mechanism described by QUIRSO and Shadowserver, and treat any vCenter host with unexplained outbound SSH activity as compromised until proven otherwise.

If a step above can’t be completed today, say so explicitly to your team rather than marking it done — a partially patched vCenter fleet is a common gap this kind of mass-scanning campaign is built to find.

DIESEC Perspective

This is a pattern we see regularly in Mittelstand environments: vCenter gets patched reactively for the vulnerabilities that make headlines, but the host’s own outbound network behavior is rarely part of the same review — which is exactly the blind spot a reverse-SSH persistence technique is designed to exploit. Hypervisor management infrastructure deserves the same monitoring rigor as a domain controller, not the “it just runs” treatment it usually gets.

Not sure whether your vCenter estate has this gap? Contact DIESEC for a rapid hypervisor exposure and outbound-traffic review.

Sources: The Hacker News | BleepingComputer
Published: 2026-08-18 | Category: Vulnerabilities & Patches | ~4 min read