Critical VMware vCenter RCE Flaw Exploited for Reverse SSH Access

Overview

A critical remote code execution vulnerability in VMware vCenter's Syslog Server component is being actively exploited in the wild, just five days after Broadcom's public disclosure. CVE-2026-59310, rated CVSS 9.8, has already compromised 361 victim IP addresses across 47 countries, with attackers deploying a Go-based reverse SSH backdoor for persistent access.

The speed and scale of the campaign — 95% of all identified victims were compromised within 48 hours of the first detected exploitation — points to a sophisticated and well-resourced threat actor, with researchers assessing moderate confidence in APT attribution.

Vulnerability Details

How It Works

CVE-2026-59310 is a directory traversal vulnerability in the vCenter Syslog Server component. An unauthenticated attacker with network access to vCenter can send a crafted request that traverses directory boundaries within the Syslog service and achieves arbitrary remote code execution on the underlying vCenter appliance. No credentials or authentication bypass are required — network reach to vCenter's management interface is sufficient.

Affected Versions

No workaround exists. Broadcom has confirmed patching is the only supported remediation.

Active Exploitation Campaign

Timeline

Attack Chain

1. Initial Access: Unauthenticated request to the vulnerable vCenter Syslog Server component exploiting the directory traversal flaw
2. Remote Code Execution: Path traversal enables execution of arbitrary commands on the vCenter appliance OS
3. Persistence: A malicious cron job is dropped on the host, surviving reboots
4. Backdoor Deployment: The cron job downloads and executes reverse_ssh, an open-source Go-based reverse shell framework

The reverse_ssh Backdoor

Attackers are deploying reverse_ssh, a legitimate open-source project written in Go, as a persistent backdoor. Its capabilities include:

• Outbound SSH connect-backs to attacker-controlled C2 servers, bypassing inbound firewall rules
• Dynamic port forwarding for lateral movement into internal subnets and hosted virtual machines
• Built-in SCP/SFTP for file staging and data exfiltration
• Encrypted SSH tunnels that blend with legitimate administrative traffic

Because reverse_ssh is a dual-use legitimate tool, network defenders should treat its unexpected presence on vCenter appliances — combined with outbound SSH connections or presence on unpatched builds — as a high-priority indicator of compromise.

Targeting and Impact

• 361 confirmed victim IPs across 47 countries
• Top 5 affected countries: Germany, United States, Turkey, Iran, France (accounting for 185 of 361 victims)
• Targets are internet-exposed vCenter management interfaces

The strategic value of vCenter as a target cannot be overstated: a foothold on vCenter grants an attacker visibility and control over all hosted virtual machines, stored credentials, snapshots, and administrative workflows in the virtualized environment — far beyond what a typical server compromise yields.

Attribution

QUIRSO GmbH's Threat Research Team, which initially documented the campaign, assesses with moderate confidence that a suspected APT actor is behind the operation based on the scale, speed, and targeting profile. No specific threat group has been publicly named. Detailed attribution evidence and IOCs are being withheld pending law enforcement coordination.

QUIRSO has released a generic YARA rule for detecting reverse_ssh binaries on vCenter appliances.

Recommended Actions

1. Patch immediately — apply the relevant vCenter fixed version from VMSA-2026-0006.1
2. Isolate vCenter management interfaces from internet exposure; place behind VPN or zero-trust access controls
3. Hunt for reverse_ssh binaries on vCenter appliances using QUIRSO's YARA rule
4. Audit cron jobs on vCenter appliances for unauthorized entries
5. Monitor outbound SSH connections from vCenter hosts, which should be rare or non-existent in normal operations
6. Review Syslog service logs for path traversal patterns (directory traversal sequences in request paths)
7. Assume compromise if running a vulnerable version and any internet exposure existed during August 3–13

References

• BleepingComputer — Critical VMware vCenter RCE flaw exploited for reverse SSH access
• Broadcom VMSA-2026-0006
• QUIRSO GmbH — Active exploitation of CVE-2026-59310
• The Hacker News — Attackers Exploit VMware vCenter Vulnerability