VMware vCenter flaw exploited five days after disclosure, with ransomware on ESXi hosts

Broadcom published an advisory on July 29, 2026 for CVE-2026-59310, a CVSS 9.8 directory traversal flaw in the vCenter Syslog server that lets an unauthenticated attacker with network access run code. Infosecurity Magazine reported on August 13 that German firm Quirso saw compromised systems contacting attacker infrastructure from August 3, and counted about 361 victim IP addresses across 47 countries, including 41 in the U.S. The Hacker News reported on August 17 that the suspected China-nexus actor also abused a related authentication bypass, CVE-2026-59309, created rogue admin accounts, harvested credentials and deployed Babuk-derived ransomware to ESXi hosts. CISA added CVE-2026-59310 to its Known Exploited Vulnerabilities catalog on August 18.

vCenter controls an organization's virtual servers. An attacker with admin rights there can reach nearly every workload, and encrypting ESXi hosts takes many systems down at once. Quirso suspected the ransomware may have partly served to destroy logs and hide the intrusion.

Confirm vCenter is on a fixed release: 9.1.0.0300, 9.0.2.0100, or 8.0 U3k or 8.0 U2f depending on your branch. Broadcom has not published a workaround. vCenter should never be reachable from the internet; ask your provider to verify that. Because patching does not evict an intruder, also check for unfamiliar accounts such as 'vcadmin' or 'adminuser,' unexpected members of the vSphere SSO Administrators group, odd cron jobs and unknown JSP files.

If you host virtual servers with a provider, ask them directly whether they were affected and what they checked.

Sources

1.Infosecurity Magazine ↗infosecurity-magazine.com
2.The Hacker News ↗thehackernews.com
3.CISA ↗content.govdelivery.com

Vendor in this insight

VMware

Server virtualization, software-defined networking, and HCI platform — acquired by Broadcom for $61B in 2023. VMware vSphere remains the dominant enterprise hypervisor running ~70% of virtualized workloads in enterprise data centers globally. Broadcom converted VMware's perpetual licenses to subscription-only in 2024, forcing all customers into VMware Cloud Foundation (VCF) bundles — causing widespread price increases of 3-10x and accelerating migration to Nutanix and Microsoft Azure Stack HCI. VMware's end-user computing (Workspace ONE, Horizon VDI) was sold to KKR and rebranded as Omnissa in 2024. Despite Broadcom controversies, vSphere remains deeply entrenched and is the primary infrastructure platform for healthcare, financial services, and government data centers.

View vendor profile

Does this affect your business?

Our advisors can help you figure out the right move, at no cost.

Talk to an advisor

VMware vCenter flaw exploited five days after disclosure, with ransomware on ESXi hosts

More on Network Security

SonicWall SMA 1000 hit by a third wave of exploited flaws in four months

Citrix NetScaler ADC and Gateway hit by two rounds of exploited flaws since August

CISA lists exploited MikroTik router and Sangoma Switchvox phone system flaws