CVE-2026-59310 vCenter Syslog Path Traversal RCE & Persistence

Ankit Mehta@Secvyn

•updated 21 days ago•0•0•5

Detects evidence of exploitation and post-exploitation activity related to CVE-2026-59310, an unauthenticated RCE vulnerability in the VMware vCenter Syslog Server. The rule monitors for suspicious child processes spawned by vmsyslogcollector, directory traversal patterns in command lines, and persistence mechanisms involving SSH authorized_keys modification, cron job creation, or systemd unit deployment on the VCSA shell.