What happened
Security outlets reported on August 12 that a critical vulnerability in Broadcom's VMware vCenter Server, tracked as CVE-2026-59310 with a 9.8 severity score, is being actively exploited. The flaw is a directory-traversal bug that lets an attacker with network access to vCenter execute arbitrary code. Broadcom disclosed and patched it in late July, but German incident-response firm QUIRSO found that compromised systems began contacting attacker infrastructure on August 3, roughly five days after the disclosure. Once inside, the attackers created malicious cron jobs running reverse_ssh, an open-source tool that opens outbound connections to infrastructure the attackers control, giving them persistent remote access that slips past firewalls focused on inbound traffic. QUIRSO identified about 361 compromised IP addresses across 47 countries, with the largest concentrations in Germany, the United States, Turkey, Iran, and France. The researchers suspect an advanced persistent threat group, though attribution remains unclear.
Why it matters for your business
vCenter is the management console for VMware virtual machines, and plenty of small and midsize companies in the DMV run it on premises, often installed and maintained by an outside IT provider. It is a one-box-controls-everything system: whoever owns vCenter can reach every virtual server it manages, including file servers, accounting systems, and domain controllers. The bigger lesson is the timeline. Five days from patch release to active exploitation means monthly maintenance windows are too slow for internet-facing infrastructure. If your business runs VMware and nobody patched in early August, you should treat this as a live incident question, not a routine update.
What to do about it
- Ask your IT provider one direct question: is our vCenter patched for CVE-2026-59310, and when was it patched?
- If the patch went on after the first week of August, have someone check for unfamiliar cron jobs or reverse_ssh activity rather than assuming you were missed.
- Make sure vCenter is not reachable from the open internet; it should sit behind a VPN or management network.
- Set an expectation with your provider that critical infrastructure patches happen in days, not at the next monthly visit.