Sofia Lindström
September 5, 2026
14 min read
A single directory traversal bug in VMware vCenter Server has turned into one of the broadest hypervisor-level ransomware campaigns of 2026. Security researchers tracking exploitation of CVE-2026-59310, a CVSS 9.8 flaw in vCenter’s Syslog server, say a suspected China-nexus actor has already compromised 361 victim IP addresses spread across 47 countries, using the access to drop Babuk-derived ransomware directly onto ESXi hosts. The campaign, first flagged in threat intelligence reporting during the week of August 17-23, 2026, has pushed the bug onto the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities (KEV) catalog alongside eight other actively exploited flaws added the same week.
The scale matters because vCenter sits at the control-plane layer of enterprise virtualization. Compromise one vCenter instance and an attacker can potentially reach every ESXi host it manages, encrypting entire virtual machine fleets in a single operation rather than chasing individual endpoints. That is precisely the pattern security teams have watched play out since the ESXiArgs wave of early 2023, and it is why this new CVE-2026-59310 disclosure has drawn attention well beyond the usual patch-Tuesday crowd.
Don’t miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Happened: The vCenter Breach at a Glance
Broadcom, which owns VMware following its 2023 acquisition, shipped a fix for CVE-2026-59310 as part of a routine security advisory cycle. Within days, threat intelligence firms tracking exploitation in the wild reported that the vulnerability was no longer theoretical. According to a weekly CVE briefing published by FireCompass, a suspected China-nexus actor used the flaw to compromise 361 distinct victim IP addresses in 47 countries, deploying a Babuk-derived ransomware strain on ESXi hosts reachable through the compromised vCenter instances.
The vulnerability itself is a directory traversal issue in vCenter’s Syslog server component that allows an attacker to escape the intended file path and achieve remote code execution. Because vCenter typically runs with elevated privileges over the hosts it manages, a successful exploit does not just compromise the management appliance, it hands the attacker a foothold that can be pivoted into every VM cluster under that vCenter’s control. FireCompass explicitly told defenders to patch VMware vCenter CVE-2026-59310 first among that week’s nine new KEV additions, given the confirmed exploitation and the ransomware payload already observed in the wild.
Inside CVE-2026-59310: How the vCenter Flaw Actually Works
Directory traversal bugs are not new to enterprise software, but the way this one lands inside vCenter’s Syslog server gives it unusual reach. Syslog components typically process log data from many sources across a network, which means they often sit exposed to internal traffic and, in some misconfigured environments, to the broader internet. An attacker exploiting CVE-2026-59310 can manipulate file paths passed to the Syslog service to write or execute code outside the directories the service was ever meant to touch, resulting in full remote code execution on the vCenter Server Appliance itself.
Once code execution is achieved on the appliance, the attacker inherits vCenter’s administrative relationship with every ESXi host it manages. That is the mechanism researchers believe let the China-nexus operators skip the slower, host-by-host intrusion process typical of ransomware campaigns and instead push Babuk-derived encryptors to entire clusters from a single compromised control point. The CVSS 9.8 score reflects that combination of low attack complexity, no authentication requirement, and total loss of confidentiality, integrity, and availability on the target.
A Second Hole: CVE-2026-59309 Compounds the Exposure
CVE-2026-59310 did not ship alone. Security researchers cataloging the same disclosure round flagged a companion bug, CVE-2026-59309, also rated CVSS 9.8, that allows unauthenticated Directory Service bypass leading to complete system access on affected vCenter deployments. The two flaws give attackers overlapping paths into the same product: one through a traversal bug in the logging pipeline, the other through an authentication bypass in the directory service layer that vCenter uses to manage identity and access.
For defenders, the practical effect is that patching one CVE without the other leaves a viable second entry point open. Organizations running vCenter in production, particularly those that have not applied Broadcom’s full security advisory for this release cycle, should treat both CVEs as a single remediation unit rather than triaging them separately. Security teams that only tracked CVE-2026-59310 because it carried the ransomware headlines risk missing CVE-2026-59309 entirely, since it has drawn far less public attention despite an identical severity score.
Babuk-Derived Ransomware: What It Does Once It’s Inside
Babuk itself first surfaced publicly in 2021 and later had portions of its source code leaked, which is why security researchers now routinely encounter Babuk-derived strains built by unrelated groups reusing the leaked codebase. The variant observed in the vCenter campaign follows that lineage: it targets ESXi’s file system directly, encrypting the virtual machine disk files (VMDKs) that back running workloads rather than encrypting inside each guest operating system individually. That approach is faster and harder to detect from within the VMs themselves, since the guest OS may show no signs of compromise until the underlying disk becomes unreadable.
Targeting ESXi at the hypervisor layer has become the preferred technique for ransomware crews going back to campaigns like ESXiArgs, LockBit’s Linux-ESXi encryptors, and Akira’s VMware-focused builds, because it multiplies the blast radius of a single intrusion. A hospital, university, or manufacturer running dozens of VMs on a handful of ESXi hosts can lose its entire virtual infrastructure in one encryption run, rather than the attacker needing to compromise each server separately. That dynamic is precisely why CVE-2026-59310’s low complexity and confirmed in-the-wild exploitation triggered such an urgent response from threat intel teams the moment it was tied to a live ransomware payload.
The Numbers: 361 IPs, 47 Countries, One Disclosure Window
The geographic spread reported by FireCompass, 361 compromised victim IP addresses across 47 countries, places this campaign firmly in the category of opportunistic mass exploitation rather than a narrowly targeted operation against a handful of high-value organizations. That pattern is typical of state-linked actors running automated scanning against newly disclosed CVEs: once a working exploit exists, the same tooling gets pointed at every internet-reachable instance of the vulnerable software, regardless of sector or size, and victims are sorted into higher-value targets only after the initial compromise.
What is harder to pin down, and worth being explicit about, is the exact timeline between public disclosure of CVE-2026-59310 and the first confirmed ransomware deployment. Threat intelligence reporting from the week of August 17-23, 2026 describes the exploitation as already underway and the CVE as one of nine additions to CISA’s KEV catalog that same week, all nine of which carried confirmed real-world exploitation. That clustering, nine actively exploited CVEs added in a single week, is itself a data point: it reflects both a genuinely aggressive threat landscape in August 2026 and a KEV catalog that has become more responsive to confirmed exploitation signals from private threat intel vendors.
CISA’s KEV Catalog and the Federal Patch Clock
Inclusion on the CISA KEV catalog is not a symbolic gesture. Under Binding Operational Directive 22-01, federal civilian executive branch agencies are required to remediate KEV-listed vulnerabilities within a set window, and CVE-2026-59310’s addition to the catalog puts every federal agency running vCenter on the clock. Private-sector organizations are not bound by the same directive, but the KEV listing functions as an industry-wide signal: cyber-insurance underwriters, security auditors, and compliance frameworks increasingly treat KEV membership as a de facto patch deadline even outside government, a dynamic covered in more detail in our CISA KEV patch workflow breakdown.
The nine KEV additions from the week of August 17-23, 2026, spanning VMware, Microsoft Windows, Microsoft SharePoint, Zimbra, MLflow, macOS, TrueConf, and an older Ray vulnerability, illustrate how broad the confirmed-exploitation surface has become across ordinary enterprise software stacks. None of these are obscure or niche products. They are the collaboration platforms, virtualization managers, and machine learning infrastructure that most mid-size and large organizations already run, which is part of why security teams describe the current patch backlog as unusually difficult to work through even with mature vulnerability management programs in place.
Historical Context: VMware Has Been Here Before
This is not the first time a VMware vulnerability has triggered a mass ransomware wave. In February 2023, the ESXiArgs campaign exploited an older, already-patched OpenSLP vulnerability (CVE-2021-21974) to encrypt thousands of internet-exposed ESXi servers within days, with mass-scanning services at the time counting well over 3,800 vulnerable hosts still reachable from the public internet nearly two years after a patch existed. That campaign became a case study in how slowly enterprise virtualization infrastructure gets patched compared to the speed at which exploit code circulates once a proof of concept goes public.
The CVE-2026-59310 campaign follows a familiar arc but compresses the timeline. Where ESXiArgs exploited a bug that had been patched for roughly 20 months, this year’s vCenter campaign appears to have moved from disclosure to confirmed ransomware deployment within the same reporting week, according to the threat intelligence firms tracking it. That acceleration reflects a broader trend security researchers have flagged repeatedly through 2025 and 2026: the gap between a CVE’s public disclosure and its first weaponized exploitation in the wild keeps shrinking, driven partly by more automated exploit development tooling on the attacker side.
Market Impact: Broadcom, Virtualization, and the Cost of a Bad Week
Broadcom’s ownership of VMware, formalized in its 2023 acquisition, already put the company under scrutiny over licensing changes and subscription pricing that pushed a meaningful share of VMware’s customer base to evaluate alternatives like Nutanix AHV, Microsoft Hyper-V, and open-source Proxmox VE. A high-severity, actively exploited vCenter vulnerability tied to a confirmed multinational ransomware campaign adds a security dimension to that migration conversation. Enterprise architecture teams already reassessing vendor lock-in on cost grounds now have a fresh, concrete incident to weigh alongside pricing when they model total cost of ownership for their virtualization stack.
The downstream cost of this class of incident tends to land in three places: incident response and forensics spend for organizations that were actually compromised, cyber-insurance premium adjustments for the broader vCenter customer base as underwriters reprice hypervisor risk, and opportunity cost for IT teams pulled off other projects to complete emergency patch cycles. None of that shows up as a single headline figure, but it compounds across an installed base as large as vCenter’s, which remains the dominant enterprise virtualization management layer despite years of customer friction with Broadcom’s licensing model.
Competitive Comparison: How Hypervisor Platforms Stack Up on Exposure
vCenter’s exposure profile differs meaningfully from its closest competitors in ways that matter to this specific incident. Microsoft Hyper-V, built into Windows Server, benefits from being patched through the same monthly cadence as the rest of the Windows ecosystem, which many enterprises already have automated. Nutanix AHV bundles its hypervisor management more tightly with its own security tooling and has pushed a simpler patch model as a selling point against VMware’s more modular architecture. Proxmox VE, the open-source option gaining traction among cost-sensitive VMware refugees, relies on community and paid-subscription patch delivery that some enterprises view as less mature for compliance-heavy environments, even though its smaller install base has historically drawn less attention from ransomware crews running opportunistic scans.
None of these alternatives are inherently immune to a CVE-2026-59310-style event; every hypervisor management layer that centralizes control over many hosts creates the same structural risk once compromised. What differs is patch velocity, exposure surface, and how quickly a fix propagates once a KEV-listed flaw appears. Organizations currently mid-migration away from VMware are watching this incident closely because it validates the risk calculus behind leaving, even if the destination platform carries its own version of the same architectural trade-off.
The Rest of August’s Critical CVE Wave
CVE-2026-59310 landed inside an unusually dense month for critical vulnerabilities. Microsoft’s August 2026 Patch Tuesday addressed 398 CVEs, including 42 rated critical, according to Tenable’s analysis, and among them was CVE-2026-68820, a Windows Ancillary Function Driver for WinSock vulnerability that Microsoft confirmed was exploited as a zero-day before the patch shipped, letting local attackers escalate to SYSTEM privileges. Check Point’s threat intelligence team separately documented CVE-2026-71362, a critical authentication flaw in Adobe Commerce and Magento Open Source that attackers began exploiting shortly after Adobe’s public disclosure, and CVE-2026-65400, the macOS Screen Sharing authentication bypass mentioned above.
Late August and early September brought more. A weekly CVE report tracked 1,877 new CVE entries in a single reporting window with six confirmed actively exploited flaws, including a CVSS 9.8 unauthenticated remote code execution bug in JetBrains TeamCity (CVE-2026-63077), an authentication-bypass-to-RCE chain in IBM’s Langflow OSS (CVE-2026-9198), and an OS command injection RCE in Progress LoadMaster (CVE-2026-8037). By September 2, Hewlett Packard Enterprise had disclosed two maximum-severity CVSS 10 flaws in its Fabric Composer product (CVE-2026-76657 and CVE-2026-76658), and Mozilla shipped fixes for CVE-2026-84119 and CVE-2026-84121 in Firefox and Thunderbird, both rated CVSS 9.6. Our recent coverage of the GitLab CVSS 9.4 bug exploited within 48 hours and the JFrog Artifactory CVSS 9.8 flaw tracks the same acceleration in time-to-exploitation across dev-tooling stacks.
Detecting Compromise: What Security Teams Should Look For
Incident responders working vCenter compromise cases point to a fairly consistent set of indicators. Unexpected Syslog service restarts, unfamiliar processes spawned by the vCenter Server Appliance’s service accounts, and outbound connections from the vCenter management network to unfamiliar IP ranges are the earliest signals available before encryption begins. Organizations that centralize vCenter and ESXi logs into a SIEM stand a meaningfully better chance of catching pre-ransomware lateral movement than those relying on the local audit logs, which the ransomware operators typically attempt to wipe once encryption starts. Teams building out that detection pipeline can start from our network segmentation against ransomware guide for the underlying control design.
# Quick vCenter Syslog service integrity check (run from vCenter Server Appliance shell)
systemctl status vmware-syslog
grep -i "reset_password|../" /var/log/vmware/vpxd/vpxd.log | tail -n 100
# Confirm patch level against Broadcom's advisory for CVE-2026-59310 / CVE-2026-59309
vpxd -vBeyond log review, network segmentation between the vCenter management plane and general-purpose corporate networks remains the single highest-leverage control available. vCenter should never be reachable from the open internet, and management-network access should be restricted to a small, monitored set of administrative jump hosts. Organizations that already isolated their virtualization management plane before this disclosure report a much narrower blast radius even when a vulnerable vCenter instance exists somewhere in their environment, because the attacker’s automated scanning simply never reaches it. The same isolation principle underpins the RCE exposure in SAP Commerce Cloud’s CVSS 10.0 flaw, where a single unpatched management endpoint again created enterprise-wide blast radius.
What Comes Next: Five Predictions
- Expect a second wave of exploitation attempts against CVE-2026-59309 specifically, once attackers realize public attention has focused almost entirely on CVE-2026-59310 and defenders may have left the companion bug unpatched.
- Cyber-insurance carriers will start asking explicit vCenter patch-level questions on renewal applications within the next two underwriting cycles, mirroring how carriers reacted to the ESXiArgs wave in 2023.
- Broadcom will face renewed pressure to publish faster, more transparent advisories for vCenter given the product’s outsized blast radius compared to single-host vulnerabilities, especially from customers already frustrated by licensing changes.
- Migration interest toward Nutanix AHV and Proxmox VE among mid-market VMware customers will tick up further, continuing a trend already visible since Broadcom’s subscription pricing overhaul.
- CISA’s KEV catalog will likely add at least one more vCenter or ESXi-adjacent CVE before the end of 2026, given how consistently hypervisor management software has attracted ransomware operator attention over the past three years.
Why This Keeps Happening to Virtualization Management Layers
The structural reason vCenter, and hypervisor managers generally, keep showing up in ransomware campaigns is straightforward: they are a single point of control over disproportionate amounts of compute and data. A traditional endpoint compromise nets an attacker one machine. A vCenter compromise nets an attacker administrative reach over every host that vCenter manages, often dozens or hundreds of virtual machines running production workloads. That asymmetry makes management-plane software a far more efficient target for ransomware operators optimizing for maximum encrypted-asset count per successful intrusion, and it is unlikely to change as long as centralized virtualization management remains the industry default.
Security researchers have argued for years that this asymmetry deserves stricter isolation requirements than most organizations actually implement, and CVE-2026-59310 is likely to become another reference point in that argument. The gap between recommended practice, isolating management planes on dedicated, tightly access-controlled networks, and actual practice, where vCenter is frequently reachable from broader internal networks for administrative convenience, is exactly the gap this campaign exploited at scale across 47 countries. Broadcom’s own security center, available at broadcom.com/support/security-center, remains the authoritative source for confirming patch status on both CVEs, and the NVD entry for CVE-2026-59310 carries the full technical scoring breakdown for teams running their own risk assessments.
Frequently Asked Questions
What is CVE-2026-59310?
It is a CVSS 9.8 directory traversal vulnerability in the Syslog server component of VMware vCenter Server that allows an unauthenticated attacker to achieve remote code execution on the vCenter Server Appliance.
Is CVE-2026-59310 being actively exploited?
Yes. Threat intelligence firms confirmed a suspected China-nexus actor exploited the flaw to compromise 361 victim IP addresses across 47 countries, deploying Babuk-derived ransomware on ESXi hosts reachable through compromised vCenter instances.
What is the difference between CVE-2026-59310 and CVE-2026-59309?
CVE-2026-59310 is a directory traversal bug in vCenter’s Syslog service. CVE-2026-59309 is a separate, equally severe (CVSS 9.8) authentication bypass in vCenter’s Directory Service. Both need to be patched; fixing one does not address the other.
Is CVE-2026-59310 on CISA’s KEV catalog?
Yes, it was added during the week of August 17-23, 2026, alongside eight other CVEs, all with confirmed exploitation, including flaws in Microsoft Windows, SharePoint, Zimbra, and macOS.
How is this different from the 2023 ESXiArgs ransomware campaign?
ESXiArgs exploited an OpenSLP vulnerability that had already been patched for roughly 20 months before the mass encryption wave hit thousands of unpatched servers. The CVE-2026-59310 campaign appears to have moved from disclosure to confirmed ransomware deployment within the same reporting week, a much shorter window.
What should organizations running vCenter do right now?
Apply Broadcom’s patches for both CVE-2026-59310 and CVE-2026-59309 immediately, verify vCenter is not reachable from the public internet, isolate the management network from general corporate traffic, and review Syslog service logs for signs of directory traversal attempts or unexpected process activity.
Does this affect ESXi directly, or only vCenter?
The vulnerabilities are in vCenter Server itself, but because vCenter manages ESXi hosts with administrative privileges, a compromised vCenter instance gives attackers a path to deploy ransomware directly onto the ESXi hosts it controls.
Are alternative hypervisors like Hyper-V or Proxmox immune to this kind of attack?
No platform is inherently immune. Any centralized virtualization management layer carries the same structural risk if a similar remote-code-execution flaw is found; the difference lies in patch cadence, exposure surface, and how tightly each vendor’s ecosystem enforces network isolation by default.
