A critical vulnerability in the VMware vCenter Syslog Server is under active exploitation. Attackers use it to inject and run malicious code, then make themselves at home on the affected systems. The path traversal flaw is tracked as CVE-2026-59310, carries a CVSS score of 9.8 and is rated critical.
Broadcom warned about the issue at the end of July and has since shipped a patch. There are no temporary mitigations to reduce the risk in the meantime. Closing this one means updating, specifically to VMware vCenter 9.1.0.0300, 9.0.2.0100, 8.0 U3k or 8.0 U2f, or newer.
Germany tops the list
Security researchers at Quirso examined compromised systems and found more of them than they would have liked. Their most recent count reached 361 IP addresses belonging to breached vCenter instances. 55 of those sit in Germany, ahead of the United States with 41 and Turkey with 38.
The timeline shows how little breathing room there is between disclosure and attack. The vulnerability became public on 29 July. Five days later, starting 3 August, the first infected systems checked in with the attackers' infrastructure. Two days after that, 343 of the 361 addresses had already appeared there. What looks like a week of response time turns out to be roughly a weekend.
reverse_ssh as a living room
To establish persistence, the attackers use reverse_ssh, an open source SSH-based reverse shell framework. It was built for pentesting, which means it ships with everything an intruder could want: automatic connection setup, SSH port forwarding, file transfer and convenient remote shell management.
That is precisely what makes detection awkward. reverse_ssh is legitimate software and does not look out of place in an admin toolbox. Running on a vCenter syslog server that nobody on the team installed it on, though, the picture is unambiguous.
What to check
Get your vCenter installations onto one of the fixed builds. Then actually look at those systems instead of just ticking off the patch. Is unexpected software such as reverse_ssh running on the instance? Are there outbound SSH connections to destinations that have no business being there? Any system that was reachable from the network between 29 July and your patch date should be treated as touched until proven otherwise.
One note on interpreting advisories: Broadcom's security bulletin carried no mention of the ongoing attacks as of this writing. An advisory staying quiet about active exploitation does not mean none is happening.