Global Threat Campaign Hits Critical VMware vCenter Flaw

Exploitation against CVE-2026–59310 began earlier this month, and patching the vulnerability may not be enough to fully mitigate the threat.

August 13, 2026

A critical vulnerability in VMware vCenter came under heavy exploitation via a single threat actor just days after public disclosure.

CVE-2026–59310 is a critical directory traversal flaw with a 9.8 CVSS score that VMware disclosed on July 29. According to VMware owner Broadcom, an attacker with network access to a vCenter instance can remotely exploit the vulnerability to execute arbitrary code in the target's virtual environment.

In a blog post this week, German incident-response (IR) firm QUIRSO said it observed exploitation activity on a global scale that stemmed from a single threat actor. During a recent IR engagement, QUIRSO's Threat Research team uncovered evidence that a suspected advanced persistent threat actor began exploiting the flaw on Aug. 3, less than a week after public disclosure.