VMware vCenter CVE-2026-59310: Five days, 361 victims, Babuk ransomware
Five days. That is how long it took for a suspected China-nexus threat actor to begin exploiting CVE-2026-59310, a CVSS 9.8 path-traversal flaw in VMware vCenter, after Broadcom publicly disclosed it. Shadowserver now tracks 361 unique victim IP addresses across 47 countries, making this one of the fastest mass-exploitation events on record for a hypervisor management platform.
What the vulnerability does
CVE-2026-59310 is a path-traversal vulnerability in VMware vCenter Server. An unauthenticated attacker with network access to the vCenter management interface can traverse directory boundaries and execute arbitrary code on the underlying host. No credentials, no user interaction, and no prior foothold are required.
Broadcom released patches last month. Five days after public disclosure, the first exploitation attempts were recorded. That window is shorter than many organizations' weekly patch review cycles, let alone a monthly cadence.
What attackers did with it
The observed attack chain follows a consistent pattern. Attackers performed path-traversal activity matching CVE-2026-59310 signatures, then deployed a malicious cron job for persistence using reverse_ssh, an open-source tool that creates SSH tunnels to attacker-controlled infrastructure. The final stage was ransomware deployment using a Babuk-derived payload, a family historically linked to China-nexus threat clusters.
Shadowserver tracks 361 unique victim IPs across 47 countries. The geographic spread suggests opportunistic mass-scanning rather than targeted intrusions: any internet-exposed vCenter without Broadcom's patch is a realistic target, regardless of organization size or sector.
What to do right now
Apply the Broadcom patch immediately. If patching requires a maintenance window, restrict network access to the vCenter management interface to a firewalled management VLAN in the interim. Audit cron jobs on vCenter hosts for unauthorized entries. Check for reverse_ssh processes or outbound SSH connections to unexpected external addresses. CISA's August 18 KEV entry sets September 8, 2026 as the FCEB mandatory remediation deadline.
If you are already compromised, isolate the vCenter host from the network, preserve forensic artifacts before any remediation steps, and audit cron modifications and outbound network connection logs to reconstruct the intrusion timeline.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you need help assessing your vCenter exposure or patching prioritization.