cyberresearch.us

TLP:CLEAR confidence:medium · #cyber-news #CVE-2026-59309 #CVE-2026-59310 #emerging

VMware vCenter Syslog Server RCE exploited in the wild

Luke Johnson / Cyber Research US

Summary

Public reporting describes active exploitation of a recently patched critical VMware vCenter Syslog Server flaw, CVE-2026-59310, to gain unauthenticated remote code execution and then persist with a reverse SSH implant. Broadcom disclosed the issue on 29 July 2026; DFIR firm QUIRSO reports compromised vCenter hosts beginning outbound C2 on 3 August, with 361 victim IPs across 47 countries by 7 August (BleepingComputer; SecurityWeek). Rapid7 also flags a companion issue, CVE-2026-59309 (authentication bypass), but the available Rapid7 text does not describe that bug or a required chain. This memo synthesizes those public articles only; it is not independent reverse engineering or lab confirmation.

Attack vector

An unauthenticated attacker with network reachability to the vCenter Syslog Server component can trigger the flaw (Broadcom via BleepingComputer). No credentials, no vendor workaround, and no additional preconditions are stated beyond that network access. vCenter is the centralized management plane for ESXi hosts, VMs, configuration, and permissions, so the exposed surface is the management appliance’s syslog service rather than guest VMs. Sources do not name a port, transport (UDP/TCP/TLS), or HTTP vs native syslog path.

Exploit

CVE-2026-59310 is described as a critical directory traversal in the vCenter Syslog Server that yields arbitrary code execution for an unauthenticated network attacker (Broadcom via BleepingComputer). Public articles do not give the traversal prefix, target file, request format, or a public PoC. After code execution, QUIRSO says operators drop the open-source reverse_ssh framework to open an outbound reverse-SSH C2 channel (persistence and firewall bypass). QUIRSO published a generic YARA rule for reverse_ssh client binaries; BleepingComputer notes legitimate use of that tool is possible, so detections need context. CVE-2026-59309 is titled by Rapid7 as an authentication bypass paired with the RCE CVE, but exploit mechanics and whether it is used in this campaign are not in the retrieved Rapid7 body.

In the wild / novelty

Disclosure (Broadcom, 29 July 2026) is distinct from exploitation. QUIRSO—not a honeypot write-up in these articles—attributes an active campaign: first victim-to-attacker connections on 3 August (five days after the patch), 151 new victim IPs on 4 August, 343 by 5 August, 361 by 7 August, spanning 47 countries with more than half in Germany, the United States, Turkey, Iran, and France (BleepingComputer). SecurityWeek independently states CVE-2026-59310 is being exploited for arbitrary code execution. No public exploit-PoC contents, no named APT, and no confirmation that CVE-2026-59309 is in the same campaign appear in these sources.

Risk

Successful abuse is full code execution on vCenter, which typically implies control over virtual infrastructure: ESXi hosts, VMs, snapshots, identities, and access policy. Failure mode is persistent remote access via outbound reverse SSH, data theft, and operational disruption of the virtualization estate (BleepingComputer). Blast radius is organization-wide for any unpatched vCenter reachable on the syslog service, including internet-exposed or poorly segmented management networks. Observed victim count (361 IPs) is a lower bound from one DFIR telemetry set, not a global census.

Remediation

Apply Broadcom’s emergency builds; vendor states there are no workarounds (BleepingComputer):

  • vCenter 9.1: 9.1.0.0300
  • vCenter 9.0: 9.0.2.0100
  • vCenter 8.0: 8.0 U3k or 8.0 U2f (branch-dependent)

Hunt for unexpected outbound SSH from vCenter, new reverse_ssh binaries (QUIRSO YARA; treat hits as suspicious, not automatically malicious), and syslog-service anomalies around 3 August 2026 onward. Restrict network access to the syslog listener to trusted collectors only. Validate patch level against the builds above and Broadcom’s FAQ (referenced by BleepingComputer; FAQ contents not in these articles).

CVE / identifiers

CVE-2026-59310 (directory traversal → unauthenticated RCE in vCenter Syslog Server). CVE-2026-59309 (auth bypass per Rapid7 title only). CWE not stated.

Confidence

medium — outlets agree on CVE-2026-59310, unauthenticated syslog-server RCE, patch IDs, and QUIRSO’s in-the-wild timeline; exploit internals (path, protocol, 59309 role) are thin or missing because Rapid7/SecurityWeek bodies are incomplete and no independent analysis was performed.

Open questions

  • Technical details of CVE-2026-59309 and whether it is chained with CVE-2026-59310.
  • Exact syslog endpoint, protocol/port, and traversal payload.
  • How QUIRSO mapped 361 IPs (confirmed vCenter owners vs. NAT/shared egress); victim verticals beyond country counts.
  • C2 infrastructure, implant configuration, and actor attribution.
  • Whether a public PoC exists beyond the observed reverse_ssh post-exploitation.

Sources