A critical vulnerability in VMware’s vCenter Server, identified as CVE-2026-59310, is being actively exploited by attackers to gain root access and deploy ransomware across virtual infrastructures. This flaw, a path traversal issue in the Syslog Server component, allows unauthenticated users with network access to execute arbitrary code on affected systems.
The exploitation of this vulnerability has been swift. Within days of its disclosure, security researchers observed a significant number of compromised systems worldwide. Specifically, 361 affected IP addresses across 47 countries were identified, spanning sectors such as technology, research, education, and telecommunications. This rapid spread underscores the attractiveness of vCenter management systems as targets for cyber attackers.
In one documented case, attackers leveraged the Syslog path traversal flaw to create malicious cron jobs under the `/etc/cron.d` directory. These jobs, executed with root privileges, facilitated the download and execution of additional malicious tools. Notably, no corresponding authentication events were recorded, indicating that the attackers exploited the vulnerability to bypass standard login procedures.
Further analysis revealed that the attackers established multiple persistence mechanisms. They created system services to restart backdoor processes, added SSH keys to the root’s authorized keys file, and deployed web shells. Additionally, they created vSphere administrator accounts and extracted credentials from the local directory service, ensuring sustained access to the compromised environments.
The attackers also targeted VMware ESXi hosts by creating local administrator accounts and transferring ransomware executables via the vSphere datastore browser. The ransomware, derived from the Babuk family, encrypted VMFS volumes, rendering virtual machines inoperable. Notably, large VMDK files were partially encrypted, with the first 512 MB affected, which was sufficient to disrupt operations.
Given the severity and rapid exploitation of this vulnerability, it is imperative for organizations to apply the latest vCenter updates without delay. Beyond patching, organizations should restrict public access to management interfaces, limit administrative access to approved networks, monitor for unauthorized account creations, and scrutinize changes to cron jobs, services, and web applications.
This incident highlights the critical importance of timely vulnerability management and the need for robust security measures to protect virtual infrastructures from emerging threats.
