CISA Warns Ransomware Gangs Are Now Exploiting Critical VMware vCenter Flaw
The US Cybersecurity and Infrastructure Security Agency has warned that ransomware operators have joined ongoing attacks exploiting a critical remote code execution flaw in VMware vCenter, tracked as CVE-2026-59310. Broadcom, which owns VMware, patched the directory traversal vulnerability in the vCenter Syslog server on July 29 and urged customers to treat the fix as an emergency, since it allows unauthenticated attackers to execute arbitrary code on affected systems.
Roughly two weeks after the patch, incident response firm QUIRSO reported that a suspected advanced persistent threat actor had already compromised more than 361 IP addresses across 47 countries by exploiting the flaw to install reverse SSH tools for persistent remote access. CISA subsequently added the vulnerability to its Known Exploited Vulnerabilities catalog in August and gave federal agencies just three days to secure their systems. Over the past weekend, the agency updated the catalog entry again to note that ransomware groups are now actively abusing the flaw, though it has not yet disclosed which ransomware operations or victims are involved. Security researchers currently track more than 450 VMware vCenter servers still exposed to the internet, with no clear picture of how many remain unpatched.
Virtualization platforms like vCenter and ESXi have become high-value ransomware targets in recent years because compromising them can hand attackers a foothold across an organization’s entire virtual infrastructure, including backup systems, in a single intrusion. Several ransomware families have built dedicated Linux encryptors specifically to target VMware ESXi virtual machines. CISA has flagged 26 VMware vulnerabilities as actively exploited over the past five years, nine of which were later tied to ransomware campaigns, reflecting a consistent pattern of ransomware groups moving quickly to weaponize disclosed virtualization flaws once proof-of-concept exploits or patches reveal how they work.