VMware vCenter CVE-2026-59310: Ransomware Gangs Join Unauth Syslog RCE

Your virtualization brain just moved from “espionage problem” to ransomware problem. CISA confirmed on September 15, 2026 that ransomware gangs have joined active exploitation of a critical VMware vCenter flaw that was supposed to be patched in July.

If vCenter is still on a build older than the fixed releases, move it to the top of the list. It manages every ESXi host you run.

What happened

On July 29, 2026, Broadcom patched CVE-2026-59310, a directory traversal in the vCenter Syslog server that lets an unauthenticated attacker with network access execute arbitrary code. Researchers later showed the path can write into /etc/cron.d for immediate root on the appliance.

CISA added the bug to KEV on August 18 (federal due August 21). Campaign reporting put roughly 361 victim IPs across 47 countries in play, with Babuk-derived ransomware (.babyk) observed on ESXi hosts after vCenter compromise. Over the weekend into September 15, CISA updated the KEV entry to flag ransomware gang abuse.

Shadowserver still sees hundreds of vCenter instances exposed online. There is no public count of how many remain unpatched.

Why it matters

vCenter is the control plane for provisioning, snapshots, and host access. Compromising it is how modern ransomware skips endpoint-by-endpoint encryption and hits the hypervisor layer instead.

The bug sits in the Syslog server, but it gives unauthenticated code execution on a box that is often reachable from wide internal networks and sometimes from the internet.

What to do first

• Inventory every vCenter Server Appliance. Upgrade to a fixed build: 9.1.0.0300, 9.0.2.0100, or 8.0 U3k / U2f for your train. Verify with vpxd -v rather than trusting a change ticket that says updates ran.
• Remove internet exposure to vCenter management. Segment the management plane so it is not a casual lateral stop.
• Hunt authentication and cron anomalies since late July: malformed cron under /etc/cron.d, unexpected reverse-SSH / webshells (Perfcharts JSP), new SSO admins, and ESXi local accounts you did not create.
• Rotate vSphere SSO and service credentials tied to the compromised plane. Confirm backups and snapshots live somewhere the vCenter service account cannot delete.
• If ransomware indicators appear on ESXi (.babyk or mass encryption), isolate, preserve forensics, and treat every managed host as in-scope.

Details

• CVE: CVE-2026-59310 (CVSS 9.8)
• Product: VMware vCenter Server (Syslog server path traversal → RCE)
• KEV: Added 2026-08-18; federal due 2026-08-21; ransomware use flagged ~2026-09-15
• Fixed builds: 9.1.0.0300 · 9.0.2.0100 · 8.0 U3k / U2f
• Workarounds: None meaningful — patch and restrict network access

Hunt / verify

• Confirm build ≥ fixed train above on every appliance.
• Review crond / systemd persistence, outbound reverse shells, and unexpected SSO administrator creation since July 29.
• Cross-check ESXi host accounts and datastore encryption events against change tickets.

Sources

• BleepingComputer: CISA — vCenter RCE now exploited by ransomware gangs (Sep 15, 2026)
• CISA Known Exploited Vulnerabilities Catalog — CVE-2026-59310
• The Hacker News: Suspected China-nexus actor exploits vCenter, Babuk-derived ransomware

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].