Hackers Turn a VMware vCenter Fix Into a Global Break-In

What Happened?

On July 29, 2026, Broadcom disclosed CVE-2026-59310, a path traversal bug in the vCenter Server syslog service. It scores 9.8 out of 10, near the top of the severity scale. Here is why it stings: no login required. An attacker with network access can write files anywhere on the appliance, then plant a scheduled job that runs as root. From there, they own the box.

By August 3, the first victim appeared. By August 5, 95% of the eventual 361 targets were already compromised. Germany, the United States, Turkey, Iran, and France absorbed the heaviest load, roughly 185 servers between them. Researchers tracking the wave tied it, with moderate confidence, to a state aligned group working out of a UTC+8 time zone, based on language artifacts and tooling patterns.

What’s the Impact?

vCenter is the control room for a VMware estate. Whoever holds it holds the keys to every virtual machine underneath. In this campaign that access got used hard.

Attackers dropped the open source reverse_ssh tool for a quiet way back in, created admin accounts with names like vcadmin and vcenter_admin, and reached down into ESXi hosts and datastores. Some intrusions ended in ransomware, a Babuk variant that renames files with a .babyk extension. In plain terms: encrypted VMs, a backdoored hypervisor, and a cleanup measured in weeks.

The timing is the real lesson. A public advisory is a starting gun for both sides. Defenders who wait a week to patch are racing an opponent who started reading the same advisory on day one.

How to Avoid This

Patch first. Move vCenter to 9.1.0.0300, 9.0.2.0100, or the 8.0 U3k / U2f branch, whichever matches your build. Then assume the window between disclosure and your patch may already have been used against you:

• Pull vCenter and ESXi management interfaces off the open internet. They belong on a restricted network, never a public IP.
• Hunt for rogue cron jobs in /etc/cron.d and unfamiliar service accounts on the appliance.
• Watch for outbound SSH from vCenter. A control plane server dialing out is a red flag.
• Check the IOC list and preserve logs before you rebuild anything.