Threat actors have started exploiting a recently patched critical-severity vulnerability in VMware vCenter, rapid incident response company Quirso reports.
The bug was disclosed on July 29, when Broadcom patched it alongside four other security defects in multiple VMware products.
Tracked as CVE-2026-59310 (CVSS score of 9.8), the flaw is described as a directory traversal issue in the Syslog server that leads to remote code execution.
“A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code,” Broadcom’s advisory reads.
According to Quirso, an advanced persistent threat (APT) actor has been exploiting web-accessible VMware vCenter servers vulnerable to CVE-2026-59310, using a reverse shell for persistent access.
