The gap between disclosure and exploitation for CVE-2026-59310 was five days. Broadcom published the advisory on July 29. By August 3 a suspected APT actor was using it in the wild, and by August 5 German forensics firm Quirso had counted 361 victim IP addresses spread across 47 countries.

The flaw itself is a path traversal in the vCenter Syslog server, rated CVSS 9.8, exploitable by anyone with network access and no credentials at all. Broadcom's advisory is explicit that there is no workaround. If you run vCenter and you have not patched, the only lever available to you is patching.

RelatedServiceNow's CVSS 9.5 Sandbox Escape Is Now Exploited

How the attack chain works

Quirso found this during an incident response engagement rather than in a lab, which means the chain below is what attackers actually did, not what researchers proved was theoretically possible.

It starts with path traversal activity consistent with CVE-2026-59310 against the Syslog service. That yields arbitrary code execution as an unauthenticated remote party. From there the operators dropped a malicious cron job, which is the persistence step and the one that matters most for cleanup, then used reverse_ssh, an open-source tool for establishing SSH connections back to attacker-controlled infrastructure. The result is an outbound, long-lived channel into the host that survives the patch.

That last point is the trap in this incident. Patching closes CVE-2026-59310. It does not remove a cron job that already exists, and it does not terminate a reverse shell someone established last week. Sectigo's Jason Soroko put it as two clocks to manage: closing the vulnerability, and evicting whoever already came through it.

Observed attack chain for CVE-2026-59310 in VMware vCenter A four-stage attack chain. Stage one, unauthenticated path traversal against the vCenter Syslog server. Stage two, arbitrary code execution on the host. Stage three, a malicious cron job is written for persistence. Stage four, reverse underscore ssh establishes an outbound channel to attacker infrastructure. A note below indicates that patching only removes stage one, while stages three and four persist after the update is applied. CVE-2026-59310 / OBSERVED CHAIN The patch closes step 1. Steps 3 and 4 stay. 01 / ENTRY Path traversal, Syslog service 02 / RCE Unauthenticated code execution 03 / PERSIST Malicious cron job written 04 / C2 reverse_ssh outbound PATCH FIXES SURVIVES THE PATCH, NEEDS EVICTION CVSS 9.8 · no workaround · disclosed Jul 29 · exploited Jul 29 + 5 days 361 victim IPs across 47 countries counted by Aug 5 genztech.blog
Fig 1 The chain Quirso reconstructed from incident response. Updating vCenter removes the entry point and nothing else.

Five days, and what that number means

Disclosure timelines have been compressing for years, but five days for a product with vCenter's deployment profile is worth sitting with. Enterprise virtualization does not patch in five days. It patches in a change window, after testing, in a maintenance slot negotiated weeks earlier, because vCenter is the thing that manages the hosts that run everything else.

So the practical situation for most of the 361 victims was not negligence. It was that the exploitation window opened before their normal process could plausibly close it. That is a structural problem with how critical virtualization infrastructure gets maintained, and it does not get solved by telling people to patch faster.

  1. Jul 29Broadcom publishes VMSA-2026-0006 CVE-2026-59310 (RCE, CVSS 9.8) and CVE-2026-59309 (auth bypass)
  2. Aug 3Active exploitation observed in the wild Five days after disclosure, suspected APT actor
  3. Aug 5361 victim IPs counted across 47 countries Germany, US, Turkey, Iran and France account for 185
  4. Aug 10Quirso publishes the attack chain Path traversal, cron persistence, reverse_ssh

Which versions are fixed?

Broadcom shipped fixes across the supported 8.0 and 9.x branches. There is nothing to configure and nothing to disable as an interim measure, which makes this table the entire remediation plan.

BranchFixed buildStatus if you are below it
vCenter 9.19.1.0.0300Vulnerable, no workaround
vCenter 9.09.0.2.0100Vulnerable, no workaround
vCenter 8.0 U38.0 U3kVulnerable, no workaround
vCenter 8.0 U28.0 U2fVulnerable, no workaround
Distribution of 361 CVE-2026-59310 victim IP addresses as of August 5, 2026 A horizontal bar chart of 361 victim IP addresses. 185 victims are concentrated in five countries, Germany, the United States, Turkey, Iran and France. The remaining 176 victims are spread across the other 42 affected countries. BLAST RADIUS / VICTIM IPs BY AUG 5 361 hosts, 47 countries, in under a week Top 5 countries (DE, US, TR, IR, FR) 185 Remaining 42 countries 176 Counted by Quirso two days after exploitation was first observed genztech.blog
Fig 2 · blast radius Roughly half the observed victims sat in five countries, but the spread across 47 total suggests untargeted internet-wide scanning rather than selection.

Why vCenter is worth this much effort

vCenter is the management plane. Compromise a virtual machine and you own a workload. Compromise vCenter and you own the thing that creates, moves, snapshots and deletes every workload underneath it, along with the credentials it holds to do that.

It is also, in a lot of environments, quietly reachable in ways nobody intended. It gets exempted from segmentation because operations teams need to reach it from everywhere. It ends up with broad outbound access because it pulls updates. Those two exemptions are exactly what turns an unauthenticated RCE into a reverse shell that phones home successfully.

RelatedA PraisonAI Flaw Was Exploited Within Hours of Disclosure

What to do today

Patch to the builds in the table, and treat that as step one of two. Then go hunting, because the population of "patched" and the population of "clean" are not the same set in this incident.

Specifically: audit cron on the vCenter appliance for entries you did not create, review outbound connections from vCenter for SSH sessions to infrastructure you do not recognize, and check whether the Syslog service was reachable from untrusted networks during the July 29 to patch-day window. If it was, assume you were scanned. Internet-wide scanning found 361 hosts in a week, and it was not being selective about who it found.

What to watch · next 90 days
  • Second-stage activity in patched estates. The cron and reverse_ssh persistence outlives the update. Expect intrusions in these victims to surface weeks after the patch went in.
  • Ransomware follow-on. An APT-grade foothold on a hypervisor management plane is exactly the access that gets sold. Hypervisor-level encryption is the obvious end state.
  • Emergency change windows become policy. Five days is shorter than most vCenter maintenance cycles. Organizations that cannot patch the management plane out-of-band will keep losing this race.
  • CVE-2026-59309 exploitation. The auth bypass shipped in the same advisory and has had the same amount of attacker attention.

Our take

The five-day number is getting the headlines, and it should, but the detail we would act on is the persistence mechanism.

Plenty of organizations will patch this, close the ticket, and mark the risk retired. The cron job does not care. Neither does the reverse shell. Quirso found this chain by doing incident response on a real environment, which means somebody had already been compromised long enough for it to matter, and the patch alone would never have told them.

The broader pattern is one we keep writing about from different angles this month. Exploitation is getting faster relative to remediation, whether the acceleration comes from AI agents reading CVE feeds mid-operation or from human operators weaponizing an advisory in under a week. Defenses built around the assumption of a comfortable patch window are running out of window.

Primary sources

Original analysis by GenZTech, built from Broadcom's advisory and Quirso's published incident response findings.