VMware vCenter CVE-2026-59310: Exploited Syslog RCE

What to do

1. Find every vCenter appliance, including those inside VCF and Telco Cloud, and check its build with vpxd -v.
2. Upgrade to 9.1.0.0300, 9.0.2.0100 or 8.0 U3k; Broadcom lists no workaround.
3. Until patched, allow syslog (514/6514) only from your ESXi hosts and the management ports only from admin jump hosts.
4. Hunt for persistence on any vCenter that was unpatched after August 3; patching does not remove implants.
5. Audit vSphere SSO administrators and local ESXi accounts, remove unknown ones, and rotate admin credentials.
6. If you find compromise, rebuild vCenter from a known-good backup and check ESXi hosts for new accounts and encrypted files.

How to check if you are affected or compromised

• List /etc/cron.d on the appliance and investigate unknown files, especially names containing poc59310 or ending in -syslog.log.
• Look for vmware-perf-update.jsp under /usr/lib/vmware-perfcharts/, an /etc/sudoers.d/vmware-perf file and /tmp/linuxFile.
• Check /var/log/vmware/esx/ for directories that do not match real ESXi host names.
• Review outbound connections from vCenter for SSH or WebSocket tunnels, and SSO accounts such as adminuser, vcadmin or vcenter_admin.

What happened#

On July 29, 2026, Broadcom published VMSA-2026-0006, which fixes CVE-2026-59310, a directory traversal flaw in the syslog server built into VMware vCenter. According to the CVE record, "a malicious actor with network access to vCenter may exploit this issue to execute arbitrary code." No login is needed. Broadcom scores it CVSS 3.1 9.8 and lists no workaround. The same advisory fixed CVE-2026-59309, an authentication bypass in the vCenter Directory Service, plus several ESXi bugs (Socura summary).

Vali Cyber's root cause analysis explains the mechanics. vCenter's rsyslog configuration builds log file paths from the hostname field of incoming messages, so a crafted hostname containing traversal sequences writes files outside /var/log/vmware/esx/. Control-character escaping is turned off, so the attacker can write a multi-line file. Writing one into /etc/cron.d yields root code execution within a minute. Vali Cyber concludes CVE-2026-59309 is not needed.

Exploitation started quickly. Incident response firm QUIRSO saw the first victims connect to attacker infrastructure on August 3, five days after the patch, and counted 361 victim IPs in 47 countries by August 7, according to BleepingComputer. The attacker installed the open-source reverse_ssh tool for remote access. HivePro, summarizing QUIRSO's research, describes a JSP web shell, new SSO administrator accounts, theft of the vCenter machine account credential, and Babuk-derived ransomware against ESXi hosts. It attributes the activity to a suspected China-nexus actor with moderate confidence. CISA added the CVE to the KEV catalog on August 18 with a three-day deadline. It later flagged the CVE as used in ransomware campaigns (BleepingComputer, Sep 15).

Who is affected#

vCenter 9.1 before 9.1.0.0300, 9.0 before 9.0.2.0100, and 8.0 before 8.0 U3k are affected. So is the vCenter shipped inside VMware Cloud Foundation 5.x and 9.x, vSphere Foundation 9.x, and Telco Cloud Platform and Infrastructure. BleepingComputer reports 8.0 U2f as the fix on the 8.0 U2 branch. VCF 5.x customers apply an async patch to vCenter 8.0 U3k. ESXi is not affected by this CVE, but it is what attackers go after once they control vCenter.

Do you really need to act?#

If you run vCenter and have not installed the July fix, yes, today. The only precondition is network access to vCenter's syslog listener. ESXi hosts and other systems on the management network reach it by design. NVD carries the vendor's 9.8 score, and CISA's enrichment marks the CVE as automatable with total technical impact. vCenter controls every VM it manages, so root on it is close to full compromise of the virtual estate.

• Internet-reachable vCenter: Shadowserver tracks more than 450 such servers. If yours was unpatched after August 3, assume compromise and hunt.
• Internal-only vCenter: still urgent, because ransomware crews use vCenter after an initial foothold. Patch now, and limit syslog to ESXi host addresses in the meantime.
• No on-premises vCenter: nothing to do.

What to do now#

1. Check each appliance's build. In the vCenter shell, run vpxd -v, or read the version in the appliance management interface on port 5480.
2. Upgrade to 9.1.0.0300, 9.0.2.0100 or 8.0 U3k. Take a file-based backup first. On VCF 5.x, stage the async patch with the Async Patch Tool.
3. Restrict access. Allow syslog (514, and 6514 for TLS) only from your ESXi hosts, and the web, SSO and LDAP ports only from admin jump hosts.
4. Hunt before you declare victory, because patching does not remove cron jobs, web shells or accounts an attacker already planted.
5. Review vSphere SSO users and the Administrators group, and the local accounts on every ESXi host. Remove unknown entries, then rotate administrator and ESXi root passwords.

How to tell if you were hit#

On the appliance, run ls -la /etc/cron.d/ and investigate anything you did not create. Reported attacker files include zz-poc59310 and names ending in -syslog.log. Run ls /var/log/vmware/esx/ and look for directories that are not real ESXi host names. HivePro lists further indicators: /usr/lib/vmware-perfcharts/tc-instance/webapps/statsreport/vmware-perf-update.jsp, /etc/sudoers.d/vmware-perf, /tmp/linuxFile, and SSO or ESXi accounts named adminuser, vcadmin or vcenter_admin. Vali Cyber advises treating unexpected outbound SSH or tunnel connections from vCenter as a confirmed compromise until proven otherwise. If you find any of these, isolate the appliance, preserve logs, and rebuild from a backup taken before August 3. Then rotate every credential vCenter held and check ESXi hosts for new local accounts and files with a .babyk extension.

Timeline#

• Jul 29, 2026 — Broadcom publishes VMSA-2026-0006 with fixed builds and no workaround.
• Jul 30, 2026 — The CVE record is published.
• Aug 3, 2026 — QUIRSO sees the first compromised vCenter systems contact attacker infrastructure.
• Aug 7, 2026 — QUIRSO's count reaches 361 victim IPs in 47 countries.
• Aug 18, 2026 — CISA adds CVE-2026-59310 to KEV, with a federal deadline of August 21.
• Sep 15, 2026 — BleepingComputer reports that CISA now marks the flaw as used in ransomware campaigns.

Vulnerability records

• CVE-2026-59310 · KEV 2026-08-18 · VMware vCenter contains a directory traversal vulnerability in the Syslog server.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Broadcom — VMSA-2026-0006: VMware vCenter and ESX vulnerabilities (advisory 38017) support.broadcom.com
2. CVE record — CVE-2026-59310 cve.org
3. NVD — CVE-2026-59310 nvd.nist.gov
4. CISA — Known Exploited Vulnerabilities: CVE-2026-59310 cisa.gov
5. Vali Cyber — CVE-2026-59310 root cause analysis valicyber.com
6. HivePro — Suspected China-nexus APT weaponizes CVE-2026-59310 hivepro.com
7. Socura — VMSA-2026-0006: multiple VMware ESX, vCenter, Workstation and Fusion vulnerabilities socura.co.uk

Coverage and analysis

1. BleepingComputer — Critical VMware vCenter RCE flaw exploited for reverse SSH access (Aug 13, 2026) bleepingcomputer.com
2. BleepingComputer — CISA: Critical VMware vCenter RCE flaw now exploited by ransomware gangs (Sep 15, 2026) bleepingcomputer.com