---
title: "VMware vCenter CVE-2026-59310: Exploited Syslog RCE"
url: https://erroneo.us/security/briefs/vmware-vcenter-syslog-rce-cve-2026-59310/
description: "Unauthenticated root RCE through vCenter's syslog server, exploited since Aug 3 and tied to ransomware. Fixed in 9.1.0.0300, 9.0.2.0100, 8.0 U3k. Patch now."
type: security-brief
section: "Security Digest"
date_published: 2026-07-29
date_modified: 2026-09-15
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Act now"
cves: ["CVE-2026-59310"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# VMware vCenter CVE-2026-59310: Exploited Syslog RCE

**Verdict: Act now.** If you run vCenter and have not installed Broadcom's July 29 fix, patch today and hunt for persistence; this is unauthenticated root code execution with hundreds of victims and ransomware use.

- **Who must act:** Anyone running vCenter Server 8.0, 9.0 or 9.1, including the vCenter inside VMware Cloud Foundation, vSphere Foundation and Telco Cloud, below the fixed builds.
- **Who can relax:** Teams with no on-premises VMware vCenter, and vCenter instances already on 9.1.0.0300, 9.0.2.0100 or 8.0 U3k that were patched before August 3 and show no signs of compromise.
- **Affected:** vCenter 9.1.x before 9.1.0.0300; vCenter 9.0.x before 9.0.2.0100; vCenter 8.0 before 8.0 U3k; VMware Cloud Foundation 5.x, 9.0.x and 9.1.x; VMware vSphere Foundation 9.0.x and 9.1.x; Telco Cloud Platform 3.0 to 5.1.x and Telco Cloud Infrastructure 3.0
- **Fixed:** vCenter 9.1.0.0300; vCenter 9.0.2.0100; vCenter 8.0 U3k (8.0 U2f on the 8.0 U2 branch, per BleepingComputer); VCF 5.x: async patch to vCenter 8.0 U3k
- **CVEs:** CVE-2026-59310
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Find every vCenter appliance, including those inside VCF and Telco Cloud, and check its build with vpxd -v.
2. Upgrade to 9.1.0.0300, 9.0.2.0100 or 8.0 U3k; Broadcom lists no workaround.
3. Until patched, allow syslog (514/6514) only from your ESXi hosts and the management ports only from admin jump hosts.
4. Hunt for persistence on any vCenter that was unpatched after August 3; patching does not remove implants.
5. Audit vSphere SSO administrators and local ESXi accounts, remove unknown ones, and rotate admin credentials.
6. If you find compromise, rebuild vCenter from a known-good backup and check ESXi hosts for new accounts and encrypted files.

### How to check if you are affected

- List /etc/cron.d on the appliance and investigate unknown files, especially names containing poc59310 or ending in -syslog.log.
- Look for vmware-perf-update.jsp under /usr/lib/vmware-perfcharts/, an /etc/sudoers.d/vmware-perf file and /tmp/linuxFile.
- Check /var/log/vmware/esx/ for directories that do not match real ESXi host names.
- Review outbound connections from vCenter for SSH or WebSocket tunnels, and SSO accounts such as adminuser, vcadmin or vcenter_admin.

## What happened

On July 29, 2026, Broadcom published [VMSA-2026-0006](https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017), which fixes CVE-2026-59310, a directory traversal flaw in the syslog server built into VMware vCenter. According to the [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-59310), "a malicious actor with network access to vCenter may exploit this issue to execute arbitrary code." No login is needed. Broadcom scores it CVSS 3.1 9.8 and lists no workaround. The same advisory fixed CVE-2026-59309, an authentication bypass in the vCenter Directory Service, plus several ESXi bugs ([Socura summary](https://socura.co.uk/threat-alerts/vmsa-2026-0006-multiple-vmware-esx-vcenter-workstation-and-fusion-vulnerabilities)).

[Vali Cyber's root cause analysis](https://valicyber.com/?p=18898) explains the mechanics. vCenter's rsyslog configuration builds log file paths from the hostname field of incoming messages, so a crafted hostname containing traversal sequences writes files outside `/var/log/vmware/esx/`. Control-character escaping is turned off, so the attacker can write a multi-line file. Writing one into `/etc/cron.d` yields root code execution within a minute. Vali Cyber concludes CVE-2026-59309 is not needed.

Exploitation started quickly. Incident response firm QUIRSO saw the first victims connect to attacker infrastructure on August 3, five days after the patch, and counted 361 victim IPs in 47 countries by August 7, according to [BleepingComputer](https://www.bleepingcomputer.com/news/security/critical-vmware-vcenter-rce-flaw-exploited-for-reverse-ssh-access/). The attacker installed the open-source reverse_ssh tool for remote access. [HivePro](https://hivepro.com/threat-advisory/suspected-china-nexus-apt-weaponizes-cve-2026-59310), summarizing QUIRSO's research, describes a JSP web shell, new SSO administrator accounts, theft of the vCenter machine account credential, and Babuk-derived ransomware against ESXi hosts. It attributes the activity to a suspected China-nexus actor with moderate confidence. CISA added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-59310) on August 18 with a three-day deadline. It later flagged the CVE as used in ransomware campaigns ([BleepingComputer, Sep 15](https://www.bleepingcomputer.com/news/security/cisa-critical-vmware-vcenter-rce-flaw-now-exploited-by-ransomware-gangs/)).

## Who is affected

vCenter 9.1 before 9.1.0.0300, 9.0 before 9.0.2.0100, and 8.0 before 8.0 U3k are affected. So is the vCenter shipped inside VMware Cloud Foundation 5.x and 9.x, vSphere Foundation 9.x, and Telco Cloud Platform and Infrastructure. BleepingComputer reports 8.0 U2f as the fix on the 8.0 U2 branch. VCF 5.x customers apply an async patch to vCenter 8.0 U3k. ESXi is not affected by this CVE, but it is what attackers go after once they control vCenter.

## Do you really need to act?

If you run vCenter and have not installed the July fix, yes, today. The only precondition is network access to vCenter's syslog listener. ESXi hosts and other systems on the management network reach it by design. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-59310) carries the vendor's 9.8 score, and CISA's enrichment marks the CVE as automatable with total technical impact. vCenter controls every VM it manages, so root on it is close to full compromise of the virtual estate.

- **Internet-reachable vCenter:** Shadowserver tracks more than 450 such servers. If yours was unpatched after August 3, assume compromise and hunt.
- **Internal-only vCenter:** still urgent, because ransomware crews use vCenter after an initial foothold. Patch now, and limit syslog to ESXi host addresses in the meantime.
- **No on-premises vCenter:** nothing to do.

## What to do now

1. Check each appliance's build. In the vCenter shell, run `vpxd -v`, or read the version in the appliance management interface on port 5480.
2. Upgrade to 9.1.0.0300, 9.0.2.0100 or 8.0 U3k. Take a file-based backup first. On VCF 5.x, stage the async patch with the Async Patch Tool.
3. Restrict access. Allow syslog (514, and 6514 for TLS) only from your ESXi hosts, and the web, SSO and LDAP ports only from admin jump hosts.
4. Hunt before you declare victory, because patching does not remove cron jobs, web shells or accounts an attacker already planted.
5. Review vSphere SSO users and the Administrators group, and the local accounts on every ESXi host. Remove unknown entries, then rotate administrator and ESXi root passwords.

## How to tell if you were hit

On the appliance, run `ls -la /etc/cron.d/` and investigate anything you did not create. Reported attacker files include `zz-poc59310` and names ending in `-syslog.log`. Run `ls /var/log/vmware/esx/` and look for directories that are not real ESXi host names. HivePro lists further indicators: `/usr/lib/vmware-perfcharts/tc-instance/webapps/statsreport/vmware-perf-update.jsp`, `/etc/sudoers.d/vmware-perf`, `/tmp/linuxFile`, and SSO or ESXi accounts named `adminuser`, `vcadmin` or `vcenter_admin`. Vali Cyber advises treating unexpected outbound SSH or tunnel connections from vCenter as a confirmed compromise until proven otherwise. If you find any of these, isolate the appliance, preserve logs, and rebuild from a backup taken before August 3. Then rotate every credential vCenter held and check ESXi hosts for new local accounts and files with a `.babyk` extension.

## Timeline

- Jul 29, 2026 — Broadcom publishes VMSA-2026-0006 with fixed builds and no workaround.
- Jul 30, 2026 — The CVE record is published.
- Aug 3, 2026 — QUIRSO sees the first compromised vCenter systems contact attacker infrastructure.
- Aug 7, 2026 — QUIRSO's count reaches 361 victim IPs in 47 countries.
- Aug 18, 2026 — CISA adds CVE-2026-59310 to KEV, with a federal deadline of August 21.
- Sep 15, 2026 — BleepingComputer reports that CISA now marks the flaw as used in ransomware campaigns.

## Sources

1. [Broadcom — VMSA-2026-0006: VMware vCenter and ESX vulnerabilities (advisory 38017)](https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017)
2. [CVE record — CVE-2026-59310](https://www.cve.org/CVERecord?id=CVE-2026-59310)
3. [NVD — CVE-2026-59310](https://nvd.nist.gov/vuln/detail/CVE-2026-59310)
4. [CISA — Known Exploited Vulnerabilities: CVE-2026-59310](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-59310)
5. [Vali Cyber — CVE-2026-59310 root cause analysis](https://valicyber.com/?p=18898)
6. [HivePro — Suspected China-nexus APT weaponizes CVE-2026-59310](https://hivepro.com/threat-advisory/suspected-china-nexus-apt-weaponizes-cve-2026-59310)
7. [Socura — VMSA-2026-0006: multiple VMware ESX, vCenter, Workstation and Fusion vulnerabilities](https://socura.co.uk/threat-alerts/vmsa-2026-0006-multiple-vmware-esx-vcenter-workstation-and-fusion-vulnerabilities)
8. [BleepingComputer — Critical VMware vCenter RCE flaw exploited for reverse SSH access (Aug 13, 2026)](https://www.bleepingcomputer.com/news/security/critical-vmware-vcenter-rce-flaw-exploited-for-reverse-ssh-access/)
9. [BleepingComputer — CISA: Critical VMware vCenter RCE flaw now exploited by ransomware gangs (Sep 15, 2026)](https://www.bleepingcomputer.com/news/security/cisa-critical-vmware-vcenter-rce-flaw-now-exploited-by-ransomware-gangs/)

---
Source page: https://erroneo.us/security/briefs/vmware-vcenter-syslog-rce-cve-2026-59310/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt