Exploitation of Critical VMware Flaws for Persistence

A critical campaign is currently targeting internet-accessible VMware vCenter systems, exploiting recently disclosed vulnerabilities to establish long-term persistence. Broadcom issued emergency updates on July 29, 2026, to address five flaws, most notably CVE-2026-59310 (RCE via Directory Traversal) and CVE-2026-59309 (Authentication Bypass), both carrying a maximum CVSS score of 9.8. Active exploitation was observed just five days after disclosure, with compromises spreading across 47 countries, particularly affecting Germany and the United States.

The threat actor, suspected to be an advanced persistent threat (APT), utilizes the open-source 'reverse_ssh' framework to bypass traditional firewall protections and maintain an outbound command-and-control (C2) channel. Given that these management servers provide centralized control over entire virtual infrastructures, successful compromise allows for massive operational disruption and data theft. Organizations are urged to patch immediately as no workarounds exist for the primary RCE vulnerability.