Five Days: How Fast Attackers Turned the vCenter Advisory Into a Campaign
- Aug 14
- 3 min read
Broadcom disclosed a critical flaw in VMware vCenter on 29 July. By 3 August, a suspected state-backed group was already using it to plant backdoors on internet-facing servers. Five days was the entire patching window, and hundreds of organisations across 47 countries did not make it.
What Happened
CVE-2026-59310 is a directory traversal vulnerability in the vCenter Syslog server, rated 9.8 on the CVSS scale. An attacker with network access to vCenter can manipulate file paths to achieve arbitrary code execution, and no credentials are needed to do it. Broadcom shipped the fix on 29 July under advisory VMSA-2026-0006, bundled with four other VMware patches.
German incident response firm Quirso found the campaign while working a client engagement and published its analysis on 10 August. The team identified 361 unique victim IP addresses across 47 countries, with roughly half concentrated in Germany, the United States, Turkey, Iran and France. After gaining execution, the attackers deployed reverse_ssh, an open source reverse shell framework, to keep a foothold. That choice is deliberate: reverse_ssh dials outbound from the compromised host, so firewall rules written to block inbound connections never see the traffic.
Why It Matters
vCenter is the control plane for the entire virtual estate. Code execution there hands an attacker administrative reach across every virtual machine, datastore and snapshot underneath it, which is why ransomware crews have spent years hunting vSphere specifically. Australian banks, health providers, universities and managed service providers all run vCenter at the core of their infrastructure, and any organisation that exposed the management interface for remote administration convenience is now the one checking logs.
While the attacker might have had prior knowledge of the vulnerability, the strong correlation between the time of disclosure and exploitation suggests the disclosure as the initial starting point for the campaign. - Quirso
What Security Teams Should Do Now
Patch immediately. Fixed builds are VMware Cloud Foundation and vSphere Foundation 9.1.0.0300 and 9.0.2.0100, and vCenter Server 8.0 U3k.
Confirm no vCenter web or Syslog interface is reachable from the internet. Management planes belong behind a VPN or jump host, not on a public IP.
Hunt for reverse_ssh. Quirso released a generic YARA rule on 10 August that detects the framework's builds.
Review outbound connections from vCenter appliances. The backdoor calls home, so inbound firewall logs will not tell you anything useful.
Treat any vCenter that was internet-facing before 3 August as potentially compromised. Patching removes the entry point, not an implant already sitting on the box.
Validate any reverse_ssh detection against authorised activity first. It is a legitimate penetration testing tool, and your own testers may be the reason it is there.
Aurian's Take
Five days is the figure security teams should sit with, well ahead of the victim count. Attackers have industrialised the gap between a vendor advisory and mass exploitation, because reading a patch diff and scanning the whole IPv4 space for a management interface are both cheap now. The exposure at those 361 addresses existed for months or years before Broadcom published anything. The advisory simply told everyone where to look. And with victims spread thinly across 47 countries, this was opportunistic internet-wide scanning rather than targeted intrusion, which means selection had nothing to do with how interesting the organisation was and everything to do with what was answering on a public IP.
That is the case for treating external exposure as something you measure continuously rather than assume. Most organisations have a network diagram that says vCenter is internal, and an internet-facing reality that quietly disagrees, usually because of a firewall rule added during a migration three years ago. Regular penetration testing and external attack surface assessment exist to close that gap. In our work at Aurian, exposed management interfaces are among the most common findings on external engagements, and they are almost never deliberate. When the next 9.8 lands, the organisations that cope well will be the ones that can answer "are we exposed?" in minutes, because someone had already checked.
The five-day window will keep shrinking, and patching speed alone will not carry an organisation through it. Knowing exactly what an attacker can see from the outside is what buys back the time.
Comments