A critical flaw in VMware vCenter Server is being mass-exploited by a suspected China-linked hacking group, with researchers tracking hundreds of breached organizations across dozens of countries within days. The vulnerability gives unauthenticated attackers a direct path to full control of the servers that manage entire virtualized data centers.
The vulnerability
The flaw, tracked as CVE-2026-59310, is a directory traversal bug in the Syslog server component of vCenter, the management console VMware administrators use to run virtual machine (VM) clusters. It carries a maximum-severity Common Vulnerability Scoring System (CVSS) score of 9.8 out of 10. An attacker who can reach a vulnerable vCenter instance over the network, with no login credentials or user interaction required, can use the bug to write files outside their intended directory and ultimately execute arbitrary code on the server.
Broadcom, which owns VMware, disclosed the flaw on July 29, 2026, alongside a second critical bug, CVE-2026-59309, an authentication bypass in vCenter's directory service that also scored 9.8. Security firm Rapid7 reported that the second flaw has been chained with CVE-2026-59310 on at least one compromised system. Broadcom's advisory covers vCenter Server 9.1 (fixed in 9.1.0.0300), 9.0 (fixed in 9.0.2.0100), and 8.0 (fixed in update U3k), along with VMware Cloud Foundation deployments that bundle vCenter. Broadcom has published no workaround; patching is the only fix.
From disclosure to mass exploitation in days
Active exploitation began on August 3, 2026, about five days after the advisory went public, according to The Hacker News and BleepingComputer. The pace of compromise accelerated quickly: security firm QUIRSO recorded 151 new victim internet protocol (IP) addresses by August 4, a running total of roughly 340 by August 5, and 361 unique compromised IP addresses across 47 countries by August 7.
Germany, the United States, Turkey, Iran and France were hit hardest, together accounting for roughly half of all victims, according to BleepingComputer and SecurityWeek. The Hacker News reported country-level counts of 55 for Germany, 41 for the United States, 38 for Turkey, 26 for Iran and 25 for France.
Inside the attack chain
Once attackers exploit the syslog directory traversal bug, they land with root-level access on the vCenter Server Appliance, the Linux-based virtual machine that runs the management software. From there, according to The Hacker News, they used curl and wget commands to pull additional tooling from two attacker-controlled servers, then set up a scheduled cron job to keep that access persistent.
The payload delivered through that cron job is a custom backdoor The Hacker News calls "linuxFile," also observed under the aliases "systemlog" and "linux_x86." It opens a WebSocket connection back to attacker infrastructure, giving them an ongoing channel to issue remote commands. Separately, BleepingComputer reported that intruders also deployed reverse_ssh, an open-source reverse shell framework, to maintain outbound connections that slip past firewall rules blocking inbound traffic. QUIRSO has since released detection rules for identifying reverse_ssh binaries on compromised hosts.
In at least one confirmed case, the intrusion escalated beyond espionage-style access. Attackers pushed a ransomware payload derived from the Babuk family onto the organization's ESXi hosts, the hypervisors that actually run the virtual machines vCenter manages, renaming encrypted files with a ".babyk" extension. Researchers looking at the case are not convinced the ransomware was the point. Because vCenter access of this depth is difficult to obtain and highly valuable for long-term intelligence collection, some believe the file encryption may be a smokescreen intended to look like ordinary cybercrime and distract from a quieter espionage or persistent-access operation underneath.
Who is behind it
QUIRSO attributed the campaign, with moderate confidence, to a Chinese-speaking threat actor likely operating in the UTC+08:00 timezone. That assessment rests on language artifacts found in the attackers' tooling, reuse of infrastructure and techniques seen in prior intrusions, and a targeting pattern that appears to deliberately exclude organizations based in mainland China. No specific espionage group has been named publicly, and the attribution remains unconfirmed.
The federal response
The scale and speed of exploitation drew a formal government response. The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-59310 to its Known Exploited Vulnerabilities (KEV) catalog on August 18, 2026. That listing automatically triggered Binding Operational Directive (BOD) 26-04, a CISA directive that requires Federal Civilian Executive Branch (FCEB) agencies to remediate catalog entries within a risk-based deadline. In this case, agencies were given just three days, with a patch deadline of August 21, 2026.
What this means for organizations running vCenter
Any organization running an affected vCenter Server version should treat this as an active, ongoing incident rather than a routine patch cycle. The exploitation window opened within days of disclosure and Broadcom has offered no interim mitigation, so unpatched instances reachable from any network attackers can reach should be assumed to be at risk.
Beyond applying the fixed builds (9.1.0.0300, 9.0.2.0100, or 8.0 U3k, depending on version), administrators should check vCenter Server Appliance systems for unfamiliar cron jobs, unexpected outbound WebSocket or SSH connections, and processes or files referencing "linuxFile," "systemlog," or "linux_x86." Because the attack grants root access to the appliance that centrally manages virtual machines, hosts, and storage, a compromise here can cascade into every workload vCenter touches, including the ESXi hosts targeted in the ransomware case. Given researchers' suspicion that the encryption seen so far may be cover for deeper access, organizations that find evidence of compromise should treat it as a potential espionage incident, not just a ransomware cleanup, and investigate accordingly rather than simply restoring from backup and moving on.
