Listen to this Post
CVE-2026-59310 is a critical directory traversal vulnerability (CWE-22) affecting the Syslog server component of VMware vCenter. The flaw stems from improper validation of pathnames within the Syslog server, allowing an unauthenticated attacker with network access to manipulate file paths and traverse outside the intended directory scope. By crafting a malicious Syslog message containing path traversal sequences (e.g., ../../../../), an attacker can write files to arbitrary locations on the vCenter appliance filesystem.
The vulnerability is remotely exploitable without authentication and requires no user interaction, making it highly dangerous. Once an attacker gains the ability to write files outside the intended Syslog directory, they can place malicious files—such as cron jobs or web shells—into sensitive system locations. This can lead to arbitrary code execution with the privileges of the vCenter service, typically root or high-level administrative access.
Broadcom disclosed the vulnerability on July 29, 2026, as part of security advisory VMSA-2026-0006. Active exploitation began just five days later, on August 3, 2026, when compromised systems started connecting to attacker-controlled infrastructure. The campaign escalated rapidly, peaking on August 4 with 151 new victim IPs observed, and by August 7, QUIRSO had identified 361 unique victim IP addresses across 47 countries.
Attackers exploiting this flaw have been observed deploying the open-source `reverse_ssh` tool to establish persistent outbound command-and-control (C2) channels that bypass inbound network controls. This allows threat actors to maintain long-term access to compromised vCenter servers, even after the initial exploitation vector is closed. Suspected advanced persistent threat (APT) actors, possibly with ties to China, are believed to be behind the campaign. Some reports also link exploitation to the deployment of Babuk-derived ransomware.
CISA added CVE-2026-59310 to its Known Exploited Vulnerabilities (KEV) Catalog on August 18, 2026, with a required action deadline of August 21, 2026. The CVSS 3.1 score is 9.8 (Critical), with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. There is no workaround for this vulnerability—patching is the only remediation.
DailyCVE Form:
Platform: VMware vCenter
Version: 8.0, 9.0.x.x, 9.1.x.x
Vulnerability: Directory Traversal (CWE-22)
Severity: Critical (CVSS 9.8)
Date: July 29, 2026
Prediction: Patch already available (July 29, 2026)
What Undercode Say:
The following Proof-of-Concept (PoC) command demonstrates how an attacker can exploit the directory traversal vulnerability by sending a crafted Syslog message to write a file outside the intended directory:
echo '<30>1 2026-08-14T12:00:00.000Z ../../../../../../opt/vmware/share/htdocs/configurev2/cve59310chkee57b163c432 research - - - CVE-2026-59310-ee57b163c432' | nc syslogserver 514
After the file is written, the attacker can access it via HTTP to execute arbitrary code:
GET /configurev2/cve59310chkee57b163c432-syslog.log HTTP/1.1
Source: GitHub PoC
Exploit: (Educational Purposes!)
- Craft Malicious Syslog Payload: The attacker constructs a Syslog message (UDP port 514) containing path traversal sequences (e.g.,
../../../../) that point to a writable web-accessible directory on the vCenter appliance, such as/opt/vmware/share/htdocs/configurev2/. - Send Payload to Syslog Server: The attacker sends the crafted message to the vulnerable vCenter Syslog server using tools like `netcat` (
nc). - File Write via Path Traversal: The Syslog server improperly handles the path traversal sequences and writes the log entry (containing attacker-chosen content) to the specified arbitrary location on the filesystem.
- Trigger Code Execution: The attacker accesses the newly written file via HTTP (e.g.,
GET /configurev2/cve59310chkee57b163c432-syslog.log). If the file contains executable code (e.g., a web shell), the vCenter web server executes it, granting the attacker remote code execution with the privileges of the service. - Establish Persistence: Post-exploitation, attackers have been observed deploying the `reverse_ssh` tool to create a persistent outbound C2 channel. They may also create malicious cron jobs (e.g., a file named
zz-poc59310-syslog.log) to maintain access.
Protection:
- Immediate Patching: Apply the official VMware security updates immediately. There is no workaround—patching is the only remediation. Update to the following fixed versions:
- vCenter 9.1: 9.1.0.0300
- vCenter 9.0: 9.0.2.0100
- vCenter 8.0: 8.0 U3k or 8.0 U2f (depending on branch)
- Network Segmentation: Restrict network access to vCenter servers and the Syslog service (UDP 514) to only trusted administrative networks.
- Firewall Rules: Implement strict firewall rules to limit which sources can send Syslog messages to the vCenter server.
- Monitoring and Detection: Review logs for unexpected Syslog activity, file access patterns, or code execution. Deploy the YARA rule released by QUIRSO to detect `reverse_ssh` client binaries.
- CISA Guidance: Follow CISA’s BOD 22-01 and BOD 26-04 guidance. Apply mitigations in accordance with vendor instructions and ensure compliance with CISA’s Forensics Triage Requirements.
Impact:
Successful exploitation of CVE-2026-59310 allows an unauthenticated attacker with network access to execute arbitrary code on the vCenter appliance with high privileges. This can lead to:
– Complete Compromise of Virtual Infrastructure: Attackers gain full control over the vCenter management console, enabling them to manipulate virtual machines, ESXi hosts, configurations, and access permissions.
– Data Theft and Ransomware Deployment: Attackers can exfiltrate sensitive data or deploy ransomware (e.g., Babuk-derived variants) across the virtualized environment.
– Persistent Remote Access: Deployment of reverse SSH tunnels provides attackers with persistent, outbound C2 channels that bypass firewalls and network security controls, allowing long-term unauthorized access.
– Operational Disruption: Attackers can shut down or alter critical workloads, leading to significant business disruption.
– Widespread Campaigns: With 361 confirmed victim IPs across 47 countries, the vulnerability poses a global threat, with exploitation occurring within days of public disclosure.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
