Single Threat Actor Hits 361 IPs via VMware vCenter Flaw CVE-2026-59310
Updated
Updated · Dark Reading · Aug 14
Single Threat Actor Hits 361 IPs via VMware vCenter Flaw CVE-2026-59310
3 articles · Updated · Dark Reading · Aug 14
Summary
QUIRSO traced a global campaign exploiting VMware vCenter flaw CVE-2026-59310 to one suspected threat actor, with 361 unique IPs affected across 47 countries and attacks still adding new victims.
Aug. 3 exploitation began less than a week after VMware disclosed the 9.8-severity directory traversal bug on July 29, letting attackers with network access execute arbitrary code on vulnerable vCenter instances.
Patching alone may not evict the intruder: the actor is using reverse_ssh to establish persistent outbound control channels that can survive software updates, prompting calls for forensic reviews of exposed systems.
The campaign peaked on Aug. 4, with the US, France, Iran and Turkey most targeted, and researchers say patch diffing could plausibly explain the five-day turnaround from disclosure to weaponization.
Security experts say VMware customers face unusually tight patch windows because vCenter is a high-value enterprise control plane, making network isolation, micro-segmentation and outbound restrictions critical alongside updates.