Cybersecurity

Attackers Hit 361 vCenter Servers Before KEV Listed It

A CVSS 9.8 vCenter flaw was under active exploitation across 47 countries within five days of its patch, per DFIR firm QUIRSO. Weeks later it still is not on CISA's KEV catalog.

CybersecurityBy Servola Tech Desk2026-08-144 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

Attackers Hit 361 vCenter Servers Before KEV Listed It

Key takeaways

German DFIR firm QUIRSO tracked 361 victim IP addresses across 47 countries connecting to attacker infrastructure by August 7, 2026, just nine days after Broadcom disclosed CVE-2026-59310, a maximum-severity 9.8 CVSSv3.1 directory-traversal flaw in VMware vCenter's Syslog Server that lets an unauthenticated attacker with network access execute arbitrary code as system.
Attacker-controlled servers first received connections from compromised vCenter instances on August 3, 2026, five days after Broadcom's advisory VMSA-2026-0006 (July 29, 2026), and QUIRSO's own report cautions that an IP address does not necessarily correspond to a unique company or physical system, so the true organizational count could differ from the raw address total.
Once inside, attackers deploy reverse_ssh, an open-source Go reverse-shell tool that dials outward to the attacker rather than accepting inbound connections, which is precisely why it survives the inbound-facing firewall rules most organizations rely on to catch a compromised server calling out for the first time.
Weeks after QUIRSO and Rapid7 both documented active, widespread exploitation, CVE-2026-59310 had still not appeared on CISA's Known Exploited Vulnerabilities catalog as of this writing, meaning any patch program that waits for a KEV listing before treating a vCenter advisory as urgent was already behind hundreds of compromised networks.

Nine Days From Patch to 361 Victims

Broadcom published VMSA-2026-0006 on July 29, 2026, disclosing CVE-2026-59310 alongside a companion authentication-bypass flaw, CVE-2026-59309, in VMware vCenter Server versions 8.0, 9.0 and 9.1. Fixed builds were made available the same day: vCenter 9.1.0.0300, vCenter 9.0.2.0100, and vCenter 8.0 U3k or U2f depending on the deployed update track.

QUIRSO GmbH, a German digital-forensics and incident-response firm, says attacker-controlled infrastructure logged its first inbound connections from exploited vCenter systems on August 3, 2026, just five days after the patch shipped. By August 7, the firm had counted 361 distinct victim IP addresses spread across 47 countries, with roughly half concentrated in Germany, the United States, Turkey, Iran and France. QUIRSO published a YARA detection rule alongside its findings but withheld some indicators of compromise while coordinating with law enforcement.

A Syslog Function That Hands Over the Whole Server

CVE-2026-59310 sits in the directory-handling logic of vCenter's Syslog Server component. Broadcom's own advisory states plainly that a malicious actor with network access to vCenter may exploit the issue to execute arbitrary code, and critically, no authentication is required first. That combination, unauthenticated plus system-level code execution, is what earned the flaw its 9.8 out of 10 severity score and what makes any internet-reachable vCenter instance an immediate target rather than a theoretical one.

vCenter is not a peripheral tool. It is the management plane for an organization's entire virtualization estate, the console that provisions, migrates and controls every virtual machine an enterprise runs. A vendor advisory for this specific product should never sit in the same queue as a routine application patch.

Why reverse_ssh Beats the Firewall Rule You Already Have

Rather than opening a listening port on the compromised vCenter server, which most network monitoring is built to flag, the attackers behind this campaign install reverse_ssh, an open-source Go tool that has the compromised machine initiate an outbound SSH connection back to attacker infrastructure. Because the connection is outbound, it can slip past firewall and network policies that are configured to block unsolicited inbound traffic but wave through ordinary-looking outbound sessions, giving the attacker a durable, hands-on-keyboard foothold that survives a simple network segmentation review.

For a device that already sits at the center of an organization's virtualization estate, that persistence mechanism turns a single unpatched vCenter server into a long-lived beachhead rather than a one-time smash-and-grab.

Original Thesis: The KEV Gap Is the Real Story Here

Most vulnerability coverage measures urgency by whether a flaw has landed on CISA's Known Exploited Vulnerabilities catalog, and many patch programs are built, formally or informally, around that same trigger. CVE-2026-59310 breaks that assumption. Independent telemetry from both QUIRSO and security firm Rapid7 documented hundreds of real-world compromises spanning 47 countries within the first week and a half of disclosure, yet as of this writing the CVE has still not appeared in CISA's catalog. A patching workflow that treats KEV inclusion as the signal to escalate a vCenter advisory to emergency status was, by definition, already weeks behind the attackers who found and weaponized this flaw.

The lesson generalizes beyond this one CVE. For infrastructure-tier software like a hypervisor management console, an independent DFIR firm's telemetry or the vendor's own severity score should be enough to trigger emergency patching on its own, without waiting for a government catalog entry that, this time, never arrived on schedule.

What vCenter Operators Should Do Now

Any organization running vCenter 8.0, 9.0 or 9.1 that has not applied the July 29 fixes should treat this as an emergency change, not a scheduled one, and should also confirm the management interface is not directly reachable from the public internet, which it never should be in the first place. Given the outbound persistence method documented here, monitoring outbound SSH connections initiated by infrastructure-tier servers, not just inbound access to them, is now part of a complete detection strategy for this specific campaign.

For EU essential and important entities under NIS2 that operate internet-facing or otherwise exposed vCenter instances during the exploitation window, this incident sits squarely inside the categories the directive was written to capture: unauthenticated remote code execution on infrastructure with confirmed active exploitation and a real prospect of confidentiality, integrity or availability impact across an entire virtualization estate.

Frequently asked questions

Is CVE-2026-59310 confirmed to be on CISA's KEV catalog?

As of this writing, no. Independent research from QUIRSO and Rapid7 documented active exploitation across 47 countries within the first ten days after disclosure, but the CVE had not yet appeared in CISA's Known Exploited Vulnerabilities catalog, which is exactly the gap this article's thesis is built on.

Does a high victim IP count mean 361 different organizations were breached?

Not necessarily. QUIRSO itself notes that an IP address does not always correspond to a unique company or physical system, so the real number of distinct organizations affected could be lower than the raw address count, though it does not change the fact that active, widespread exploitation is confirmed.

We already patched to the fixed vCenter build. Are we still exposed?

Patching closes the entry point going forward, but it does not remove a backdoor already installed before the patch was applied. Any vCenter instance that was internet-reachable and unpatched between August 3 and the date you applied the fix should be checked for reverse_ssh or unexplained outbound SSH sessions before being considered clean.

A hypervisor management console with a 9.8 severity score was compromised across 47 countries inside ten days, and weeks later a government exploited-vulnerabilities list still had not caught up. The vendor advisory and the independent telemetry were the real alarm; anyone still waiting on the catalog entry was reading the story a step behind the attackers.

VMware vCenterBroadcomCVE-2026-59310reverse SSH backdoorCISA KEV catalogNIS2

DeadLock Hides Its Leak Site Inside a Blockchain

Microsoft's own researchers detail how the DeadLock ransomware group hosts its leak site and victim chat on Polygon blockchain smart contracts and the Session messenger, removing the single points of failure law enforcement has relied on to disrupt ransomware operations.

5 min read

Cybersecurity

Autonomous AI Agents Attacked Taiwan's Government

Over four days in July 2026, up to eight AI agents built on open-source tools breached 85+ Taiwan government accounts and reached the grid. Why this is an EU risk too.

4 min read

Decisions

The Third Pivot Was the Warning Magic Leap Missed

Magic Leap filed a WARN notice for 193 layoffs effective 1 October 2026, its fourth strategic pivot after $4 billion raised. The lesson is the pattern, not the pivot.