Global Threat Campaign Hits Critical VMware vCenter Flaw

A suspected advanced persistent threat actor has launched a global campaign exploiting CVE-2026–59310, a critical directory traversal vulnerability in VMware vCenter with a CVSS score of 9.8. German security firm QUIRSO reported observing active exploitation beginning on August 3, just days after Broadcom and VMware disclosed the flaw on July 29.

The attack targets allow remote code execution in virtual environments, affecting infrastructure across 47 countries including the US, France, Iran, and Turkey. Notably, attackers establish post-exploitation persistence using the reverse_ssh tool, meaning that simply applying the patch may not remove existing backdoors from compromised systems. Organizations are advised to conduct forensic investigations and isolate management interfaces to prevent continued command-and-control access.