A critical VMware vCenter vulnerability, CVE-2026-59310, is being actively exploited by attackers, putting organizations running vulnerable vCenter Server deployments at risk.
The flaw is a directory-traversal vulnerability in the vCenter Syslog server and carries a CVSS score of 9.8 (Critical). An attacker with network access can exploit the vulnerability to execute arbitrary code on an affected vCenter system.
Security researchers have reported exploitation across 47 countries, with hundreds of unique victim IP addresses observed. Attackers have reportedly used the vulnerability to establish persistent remote access, increasing the risk of further compromise.
Recommended Actions
Organizations using VMware vCenter should:
Apply Broadcom's security updates immediately.
Restrict external access to vCenter management interfaces.
Review logs for suspicious activity and unauthorized access.
Monitor for unexpected processes, accounts, or network connections.
Investigate systems for signs of compromise before and after patching.
Why It Matters
VMware vCenter serves as a central management platform for virtualized infrastructure. Successful exploitation could therefore provide attackers with a powerful foothold inside enterprise environments.
Conclusion
The active exploitation of CVE-2026-59310 makes this a high-priority security issue for VMware administrators. Organizations should patch immediately and conduct threat hunting rather than relying on patching alone.
