Full Report
A recently patched critical vulnerability (CVE-2026-59310) in VMware vCenter Syslog Server is being exploited in an active campaign to deploy a reverse SSH tool for persistence and remote access. [...]
Analysis Summary
# Vulnerability: Critical RCE in VMware vCenter Syslog Server
## CVE Details
- **CVE ID:** CVE-2026-59310
- **CVSS Score:** 10.0 (Critical - estimated based on vendor description)
- **CWE:** CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - 'Path Traversal')
## Affected Systems
- **Products:** VMware vCenter Server
- **Versions:**
- vCenter 9.1 (prior to 9.1.0.0300)
- vCenter 9.0 (prior to 9.0.2.0100)
- vCenter 8.0 (prior to 8.0 U3k or 8.0 U2f)
- **Configurations:** Systems running the vCenter Syslog service accessible via the network.
## Vulnerability Description
A critical directory traversal flaw exists within the vCenter Syslog service. An unauthenticated attacker with network access can exploit this vulnerability to bypass security restrictions and perform unauthorized file operations. This leads to Remote Code Execution (RCE) on the underlying appliance, allowing for full system compromise.
## Exploitation
- **Status:** Exploited in the wild (Active campaign identified starting August 3, 2026).
- **Complexity:** Low
- **Attack Vector:** Network
- **Observed Payloads:** Use of the open-source `reverse_ssh` framework to establish persistent outbound command-and-control (C2) channels.
## Impact
- **Confidentiality:** High (Full access to centralized management data)
- **Integrity:** High (Ability to modify virtual infrastructure and configurations)
- **Availability:** High (Potential for complete operational disruption)
## Remediation
### Patches
Broadcom has released emergency updates. Administrators should upgrade to:
- **vCenter 9.1:** 9.1.0.0300
- **vCenter 9.0:** 9.0.2.0100
- **vCenter 8.0:** 8.0 U3k or 8.0 U2f (depending on the specific release branch)
### Workarounds
- There are **no official workarounds** or mitigations available. Immediate patching is the only recommended course of action.
## Detection
- **Indicators of Compromise (IoCs):**
- Outbound SSH connections to unknown or unauthorized external IP addresses (indicative of `reverse_ssh` activity).
- Presence of `reverse_ssh` client binaries on the vCenter appliance.
- **Detection Methods:**
- Use the [generic YARA rule](https[:]//github[.]com/QUIRSO/QTRDetectionContent/blob/main/2026-08-10_reverse_ssh_generic[.]yar) provided by QUIRSO to scan for the reverse SSH framework.
- Monitor vCenter Syslog service logs for unusual path traversal patterns or unauthorized access attempts.
## References
- **Vendor Advisory:** [Broadcom Support Portal](https[:]//support[.]broadcom[.]com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017)
- **FAQ/Guidance:** [VMware VCF Security Guidelines](https[:]//github[.]com/vmware/vcf-security-and-compliance-guidelines/tree/main/security-advisories/vmsa-2026-0006)
- **Research Source:** [QUIRSO Analysis - Medium](https[:]//medium[.]com/@quirso_de/active-exploitation-of-cve-2026-59310-361-victim-ips-across-47-countries-9783187cc6ff)