Threat actors have begun to actively exploit a recently patched critical security flaw in **Broadcom VMware vCenter**, according to new findings from **QUIRSO**. ### The Vulnerability: CVE-2026-59310 The vulnerability in question is **CVE-2026-59310** (CVSS score: 9.8), a directory-traversal vulnerability in the **VMware vCenter Server**. A malicious actor with network access can exploit this flaw to execute arbitrary code. Patches for the flaw were released by **Broadcom** late last month. ### Active Exploitation and Persistence The German cybersecurity company **QUIRSO** discovered the activity following an incident response engagement. The attack chain exhibited path traversal consistent with the flaw, followed by the deployment of a malicious cron job. This job established persistence on the host using **reverse_ssh**, an open-source tool for setting up SSH connections to threat actor-controlled infrastructure. Compromised systems were found to first establish contact with the attacker's domains on August 3, five days after **Broadcom** publicly disclosed the flaw. In total, **QUIRSO** identified 361 unique victim IP addresses across 47 countries, with the majority located in Germany, the U.S., Turkey, Iran, and France. **QUIRSO** noted, "While the attacker might have had prior knowledge of the vulnerability, the strong correlation between the time of disclosure and exploitation suggests the disclosure as the initial starting point for the campaign." ### Suspected APT Activity and Historical Context While the specific identity of the attackers remains unconfirmed, the sophistication of the campaign suggests the work of a suspected advanced persistent threat (APT) actor. **VMware** appliances have historically been lucrative targets for state-sponsored threat actors. Chinese threat actors like **UNC5174** have previously weaponized security flaws impacting **VMware Tools** and **VMware vCenter** in various espionage campaigns. In April 2025, **SentinelOne** disclosed details of a China-nexus threat cluster dubbed **PurpleHaze** that utilized a Windows backdoor called **GoReShell**, which leverages functionalities from **reverse_ssh**. ### The Role of reverse_ssh The use of **reverse_ssh** is particularly notable. It allows attackers to establish an outbound connection to their controlled endpoints, effectively bypassing security controls designed to prevent suspicious inbound requests. **QUIRSO** advises caution: "The presence of **reverse_ssh** should not, by itself, be treated as proof of malicious activity. In combination with unauthorized installation, unexpected outbound connections or execution on a vulnerable **vCenter** appliance, however, it is a high-priority indicator requiring investigation." ### Broader Scanning Efforts This disclosure coincides with reports from **Defused Cyber** of a spike in scanning against **VMware vCenter**, indicative of potential exploitation efforts targeting **CVE-2026-59309** (CVSS score: 9.8). This separate vulnerability is an unauthenticated authentication bypass in **vmdir**. Denis Szadkowski, COO and co-founder of **QUIRSO GmbH**, clarified that there isn't enough evidence to directly correlate the exploitation of **CVE-2026-59310** with the scanning activity targeting **CVE-2026-59309**. Szadkowski added, "What we can say with much higher confidence is that the activity we investigated represents a successful compromise rather than merely exploitation attempts, and the forensic evidence strongly points toward **CVE-2026-59310** as the initial access vector."