Broadcom patched it on July 29. Five days later, a state-grade actor was already root on vCenter servers in 47
countries.
CVE-2026-59310 — a CVSS 9.8 directory traversal in VMware vCenter — went from public disclosure to global exploitation by a suspected China-nexus APT in under a week. Roughly 361 IPs compromised, and in at least one case the intrusion ended in Babuk-derived ransomware on ESXi.
WHAT ACTUALLY HAPPENED
The flaw gives immediate, non-interactive code execution as root on the vCenter Server Appliance — no credentials, no user interaction, no second stage needed to get privileged.
Attackers dropped a backdoor ("linuxFile") persisted through cron jobs, added reverse_ssh binaries for durable access, and on at least one appliance chained it with CVE-2026-59309, an authentication bypass now under active scanning. German IR firm QUIRSO attributes the campaign with moderate confidence to a Chinese-speaking actor operating in UTC+08:00, based on Chinese-language artifacts in attacker scripts and tooling. CISA added CVE-2026-59310 to the KEV catalog on August 18.
WHY VCENTER CHANGES THE MATH
vCenter is not another application server. It is the control plane for every VM, every datastore, every ESXi host underneath it. Root on vCenter is not lateral movement — it is checkmate on the virtualization estate in one move.
That is exactly why ransomware crews follow APTs into these boxes. Encrypting at the hypervisor layer skips every in-guest EDR agent you paid for. The espionage actor opens the door; the extortion payload walks through it.
WHAT TO DO NOW
PATCH VCENTER TODAY, NOT IN THE NEXT MAINTENANCE WINDOW — five days from disclosure to mass exploitation means your change-approval cycle is now slower than the adversary's tooling cycle.
ASSUME COMPROMISE IF YOU PATCHED LATE — hunt for unexpected cron entries, unknown binaries in appliance paths, reverse_ssh processes, and outbound SSH from VCSA that no runbook explains.
TAKE VCENTER OFF THE FLAT NETWORK — management interfaces belong on a segmented, jump-host-only network, never reachable from general user VLANs or the internet.
WATCH FOR THE PAIRED BUG — CVE-2026-59309 is being scanned in the same campaign; treat the two as one problem, not two tickets.
Your hypervisor management plane is the highest-value asset you probably do not monitor like one.
How fast could you actually patch vCenter if the clock started this morning?