Critical VMware vCenter RCE flaw exploited for reverse SSH access

Attackers are actively exploiting a critical VMware vCenter vulnerability to install a reverse SSH tool that provides persistent remote access to compromised systems.

The VMware vCenter RCE flaw, tracked as CVE-2026-59310, affects the vCenter Syslog Server. Researchers have identified 361 affected IP addresses across 47 countries, with many victims located in Germany, the United States, Turkey, Iran and France.

Attackers exploit patched vCenter flaw

Broadcom disclosed CVE-2026-59310 on 29 July and rated it critical. The directory traversal flaw allows an unauthenticated attacker with network access to execute arbitrary code on a vulnerable vCenter Syslog Server.

Broadcom has not provided a workaround or mitigation. Instead, it has urged administrators to install the emergency security update as soon as possible.

The patched releases are:

• vCenter 9.1: 9.1.0.0300
• vCenter 9.0: 9.0.2.0100
• vCenter 8.0: 8.0 U3k or 8.0 U2f, depending on the release branch

VMware vCenter gives administrators central control over virtual machines, ESXi hosts, configurations and access permissions. As a result, a successful compromise can give attackers a route into critical parts of an organisation’s infrastructure.

Campaign began days after patch release

Digital forensics and incident response company QUIRSO observed compromised vCenter systems connecting to attacker-controlled infrastructure from 3 August.

That activity began just five days after Broadcom published the advisory and released patches.

The number of observed victims grew quickly. Researchers found 151 new affected IP addresses on 4 August, while the total reached 343 by the following day.

By 7 August, QUIRSO had identified 361 victim IP addresses across 47 countries. The figures reflect exposed systems detected in the campaign and may not represent every compromised organisation.

Reverse SSH tool enables persistence

After gaining access to vulnerable vCenter servers, the attackers deployed the open-source reverse_ssh framework.

The tool creates an outbound connection to attacker-controlled infrastructure. This can give an intruder persistent remote access while helping traffic bypass firewall rules and other inbound network controls.

QUIRSO released a generic YARA rule to detect reverse_ssh client binaries. However, security teams should review matches carefully because legitimate deployments of the tool can also trigger the rule.

The researchers believe an advanced persistent threat actor may be behind the campaign. They have not shared evidence supporting that attribution and are withholding detailed indicators while coordinating with law enforcement.

Administrators should patch immediately

Organisations running VMware vCenter should identify exposed Syslog Server instances and apply the relevant fixed version without delay.

Security teams should also review logs for unexpected outbound SSH connections, investigate suspicious processes and check for signs of reverse_ssh binaries or other persistence mechanisms.

Because this VMware vCenter RCE flaw does not require authentication, unpatched systems reachable over the network face a particularly serious risk. Fast patching and a focused compromise review are essential, especially for vCenter servers managing production environments.