Latest / The Digital Warfare Podcast / EP. 145: VMware vCenter Under Attack: CVE-2026-59310 Enables Persistent Access
Transcript
- Digital Warfare: You're listening to the Digital Warfare Podcast. Today we are covering an actively exploited vulnerability in VMware vCenter that gives remote attackers something far more valuable than access to a single server. It gives them a position inside the system that controls the virtual infrastructure behind it. And the key issue is not simply remote code execution, it is control of the virtualization management plane. Here's what happened. The vulnerability is tracked as CVE-2026-59310. It affects the Syslog server inside VMware vCenter and carries a CVSS score of 9.8. Broadcom describes it as a directory traversal vulnerability that allows an attacker with network access to the vCenter service to execute arbitrary code. No valid account is required, no user interaction is required, and there is no workaround. Broadcom released patches on July 29th, but exploitation followed quickly. Compromise systems began connecting to attacker-controlled infrastructure by August 3rd, just five days after public disclosure. By August 7th, researchers had observed 361 victim IP addresses across 47 countries. That number does not equal 361 confirmed organizations because some addresses belong to hosting providers, cloud networks, or shared infrastructure. But the geographic spread demonstrates how quickly the vulnerability was operationalized. After gaining access, attackers deployed an open source tool called reverse underscore SSH. The tool creates an outbound SSH connection from the compromised vCenter system to attacker infrastructure. That matters because many enterprise firewalls are designed to restrict inbound access while allowing established systems to communicate outward. The attacker effectively turns the trusted vCenter server into the system initiating the connection. Once that channel exists, it can provide persistent command execution and remote access while bypassing controls built primarily around blocking unsolicited inbound traffic. And vCenter is not an ordinary application server, it centrally manages VMware environments, virtual machines, ESXi hosts, configurations. Permissions and critical infrastructure workloads. Compromise of that management plane can provide attackers with visibility and authority far beyond the initial appliance. The affected vCenter branches require immediate updates. Version 9.1 should be upgraded to 9.1.0.0300. Version 9.0 to 9.0.2.0100. And VCenter eight point zero environments should move to the appropriate fixed eight point zero release, including eight point zero U three K for the current branch. Because there is no workaround, organizations cannot safely rely on configuration changes instead of patching. For defenders, the first priority is identifying every vCenter environment and determining whether the management interface was reachable from untrusted networks. Second, apply the fixed release immediately. Third, Investigate for unauthorized binaries, unexpected outbound SSH connections, unusual size log activity, newly created persistence, and suspicious processes running under vCenter services. Fourth, examine firewall and proxy logs for connections originating from vCenter toward unfamiliar external infrastructure. And finally, if exploitation is suspected, treat the system as compromised even after patching. Preserve evidence. Rotate privileged credentials, validate ESXi hosts and virtual machines, review administrative changes, and determine whether attackers used vCenter access to move deeper into the environment. The strategic lesson is direct. Virtualization platforms concentrate enormous operational authority. When attackers compromise the management layer, they do not need to attack every server individually. They gain access to the system designed to control them all, protect the management plane. Because once attackers own the control layer, everything underneath it becomes part of the investigation. This has been your Digital Warfare Daily Brief. Stay secure. We'll see you tomorrow.