Threat actors have launched an active exploitation campaign targeting a critical security vulnerability in Broadcom VMware vCenter, compromising 361 unique victim IP addresses across 47 nations, according to new findings from QUIRSO, a German cybersecurity firm. The flaw, designated CVE-2026-59310 and carrying a CVSS score of 9.8, allows attackers with network access to execute arbitrary code through a directory-traversal weakness. Broadcom released patches for the vulnerability late last month.
QUIRSO discovered the campaign during an incident response investigation and found that compromised systems first contacted attacker-controlled domains on August 3, just five days after Broadcom publicly disclosed the flaw. The attack pattern involves path traversal activity aligned with the vulnerability, followed by installation of a malicious cron job that establishes persistence using reverse_ssh, an open-source tool for creating SSH connections to infrastructure controlled by threat actors. Most of the 361 victim IP addresses are located in Germany, the United States, Turkey, Iran, and France, though the attacker's identity remains unknown.
The report notes that while the attacker may have possessed advance knowledge of the vulnerability, "the strong correlation between the time of disclosure and exploitation suggests the disclosure as the initial starting point for the campaign." QUIRSO believes the activity represents the work of a suspected advanced persistent threat actor. Denis Szadkowski, COO and co-founder of QUIRSO GmbH, told The Hacker News that forensic evidence "strongly points toward CVE-2026-59310 as the initial access vector" and that the activity represents "a successful compromise rather than merely exploitation attempts." The firm cautioned that reverse_ssh's presence alone shouldn't be treated as proof of malicious activity, but "in combination with unauthorized installation, unexpected outbound connections or execution on a vulnerable vCenter appliance, however, it is a high-priority indicator requiring investigation."
The use of reverse_ssh is significant because it enables attackers to establish outbound connections to endpoints under their control, effectively circumventing security controls designed to block suspicious inbound requests, according to QUIRSO. VMware appliances have historically attracted Chinese threat actors like UNC5174, who've weaponized security flaws in VMware Tools and VMware vCenter for espionage operations. In April 2025, SentinelOne revealed a China-linked threat cluster called PurpleHaze that targeted a South Asian government-supporting entity using a Windows backdoor named GoReShell, which incorporated reverse_ssh functionality. Meanwhile, Defused Cyber reported observing a spike in scanning activity against VMware vCenter that indicates potential exploitation attempts targeting CVE-2026-59309, a separate critical flaw with a CVSS score of 9.8 involving unauthorized authentication bypass in vmdir.
Organizations running VMware vCenter should apply Broadcom's patches immediately and monitor for unexpected outbound SSH connections or unauthorized reverse_ssh installations, particularly on vulnerable appliances. The rapid timeline between disclosure and active exploitation underscores the urgency of patching critical infrastructure vulnerabilities before threat actors can weaponize them at scale. For enterprises that have delayed patching cycles or rely on legacy VMware deployments, this campaign illustrates the widening gap between vendor response times and the operational realities of maintaining secure, always-on infrastructure. Security teams must weigh the friction of emergency patching against the certainty that sophisticated actors will capitalize on any delay.