VMware vCenter CVE-2026-59310: Rotate Infrastructure Secrets After RCE

Broadcom has patched CVE-2026-59310, a critical directory-traversal vulnerability in VMware vCenter Server that can let a network-access attacker execute arbitrary code. The vendor assigns it a CVSS score of 9.8 and says there is no workaround. Security company QUIRSO now reports observing exploitation that deployed reverse SSH access to affected systems, turning an urgent patch into a potential incident-response event.

The distinction between confirmed and reported facts matters. Broadcom confirms the vulnerability, affected products and fixed releases. The active-exploitation campaign, persistence method and scope come from QUIRSO's research, independently covered by BleepingComputer and The Hacker News; Broadcom has not publicly confirmed that campaign.

What Broadcom confirms about CVE-2026-59310

Broadcom's VMSA-2026-0006.1 advisory describes CVE-2026-59310 as a directory-traversal flaw in the vCenter Syslog Server. An attacker with network access to vCenter may exploit it to execute arbitrary code. The advisory was initially published on July 29, updated on August 3 and lists no workaround, so restricting exposure is useful risk reduction but is not a substitute for installing the vendor's update.

The same advisory covers several other vulnerabilities, including the separate CVE-2026-59309 authentication bypass. They should not be merged into one exploit claim. This article focuses on reported exploitation of CVE-2026-59310 and uses Broadcom's response matrix for remediation.

What researchers report—and what the numbers mean

QUIRSO says it observed affected vCenter systems connecting to attacker-controlled infrastructure from August 3 and identified use of the open-source reverse_ssh tool for persistent remote access. The company reported 361 IP addresses across 47 countries, with more than half in Germany, the United States, Turkey, Iran and France.

Those figures are useful exposure signals, not a verified victim count. One organization can operate multiple IP addresses, while shared or changing infrastructure can make one address represent more than one system over time. BleepingComputer and The Hacker News provide editorially independent reporting, but their campaign details trace back to the same QUIRSO telemetry rather than separate detections. Attribution, the number of unique organizations and the attackers' objectives remain unknown.

Which versions should be installed?

Administrators should match their exact product line against the current Broadcom advisory. At publication, the response matrix lists vCenter 9.1.0.0300 for 9.1.x, 9.0.2.0100 for 9.0.x, and either 8.0 U3k or 8.0 U2f for the corresponding vCenter 8.0 branches. VMware Cloud Foundation 5.x uses the asynchronous patch to 8.0 U3k, while affected Telco Cloud product lines follow Broadcom KB449886.

Patch labels and support guidance can change. Verify the appliance version, deployment topology and latest vendor matrix before maintenance, and do not infer that an ESXi patch with a similar label is the required vCenter update.

Why vCenter compromise changes credential assumptions

vCenter is a virtualization control plane. Administrators, automation platforms, backup products, monitoring systems and recovery workflows may all authenticate to or through it. Arbitrary code execution on that management appliance does not prove that every connected credential was stolen, but it can put local trust material, active sessions and reachable integration secrets inside the investigation boundary.

Patching closes the known entry point; it does not automatically remove persistence or invalidate credentials already observed by an intruder. If evidence shows the appliance was compromised—or the available telemetry cannot establish otherwise—teams should scope credential exposure as part of recovery, not treat the update as the final step.

A defensive response sequence

Reduce exposure and preserve evidence. Restrict management access, retain vCenter, identity, firewall, DNS and proxy logs, and coordinate evidence capture before destructive cleanup.
Apply Broadcom's supported update. Follow the current response matrix for the exact vCenter or Cloud Foundation branch and verify the installed build afterward.
Hunt for persistence. Review unexpected processes, services, files, accounts, SSH activity and outbound connections. Treat generic detection rules as leads requiring validation, not proof on their own.
Map the trust graph. Identify administrative identities, SSO relationships, service accounts, backup integrations, API tokens and automation credentials that the affected system could access.
Revoke before rotating. End suspicious sessions and disable compromised paths, then rotate scoped credentials from a known-clean administrative device in an order that avoids re-seeding secrets into an untrusted appliance.
Validate recovery. Confirm logging, alerting and integrations after remediation, monitor for renewed access, and document which credentials were rotated or deliberately retained.

Use a clean recovery channel for replacement secrets

Incident rooms, tickets and email threads are good coordination tools but poor permanent homes for replacement passwords, API tokens or break-glass codes. Before sending a new value, confirm the recipient's identity through a separately verified channel and ensure their endpoint and account are not part of the suspected compromise.

Send only the minimum credential needed, use a short expiry or one-time retrieval where practical, and rotate again if delivery cannot be verified. For pre-planned high-impact recovery material, splitting release authority between multiple trusted holders can reduce dependence on one person or one compromised account.

Where Secretus fits—and where it does not

Secretus can support the narrow, approved handoff of a replacement infrastructure password, API token or recovery code after the team has verified both recipient and destination. A short-lived one-time link reduces durable plaintext copies in chat and email; Team Split can support a pre-arranged multi-person release of break-glass material.

Secretus does not patch vCenter, detect CVE-2026-59310 exploitation, remove reverse SSH, verify an administrator's identity or make a compromised browser safe. Do not use it to move VM exports, backups or entire credential vaults. Endpoint trust, IAM, logging, forensics and vendor remediation remain the controls that contain the incident.

What remains unknown

Broadcom has not publicly confirmed the campaign described by QUIRSO, and no public evidence establishes how many unique organizations were compromised. It is also unclear whether every observed IP represented successful exploitation, how access was used after deployment or whether other persistence mechanisms were present. Organizations should base incident decisions on their own logs and forensic evidence rather than treating the public telemetry as proof about a specific environment.