GoKawiilCISA confirms ransomware groups exploiting critical VMware vCenter flaw CVE-2026-59310
CISA has updated its Known Exploited Vulnerabilities catalog to flag ransomware gangs actively exploiting a critical VMware vCenter directory traversal flaw, CVE-2026-59310, patched by Broadcom in July. The bug had already been abused by a suspected APT group to compromise over 361 IP addresses across 47 countries, and Shadowserver now tracks more than 450 exposed vCenter servers online.
GoKawiil's interpretation of the reporting above, not reported fact.
vCenter and ESXi servers sit at the core of enterprise virtual infrastructure, so compromising them can give attackers a foothold across an entire network and its sensitive data. Ransomware groups increasingly build custom encryptors targeting VMware environments, making unpatched, internet-exposed vCenter servers a high-value and high-impact target.
- CVE-2026-59310 is a critical unauthenticated RCE flaw in vCenter's Syslog server, patched by Broadcom on July 29.
- CISA's KEV catalog now shows both APT actors and ransomware gangs actively exploiting the flaw.
- Over 450 vCenter servers remain exposed online, with unclear patch adoption despite CISA's emergency deadline for federal agencies.
Source: bleepingcomputer.com, 2026-09-15
Published there as: “CISA: Critical VMware RCE flaw now exploited by ransomware gangs”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.