Attackers linked with moderate confidence to a Chinese-speaking threat actor exploited VMware vCenter CVE-2026-59310 and used one investigated compromise to deploy Babuk-derived ransomware.
CVE-2026-59310 carries a CVSS score of 9.8 and allows arbitrary code execution through a vCenter Syslog directory-traversal flaw.
Attackers established persistence, stole credentials, reached ESXi hosts, and eventually deployed ransomware.
Enterprises should patch vCenter, investigate privileged access, and strengthen endpoint detection and access controls around virtualization administrators.
A suspected China-nexus campaign has turned a critical VMware vCenter vulnerability into an enterprise intrusion path. Researchers linked exploitation of CVE-2026-59310 to persistence mechanisms, credential theft, ESXi access, and, in one investigated environment, deployment of Babuk ransomware-derived code.
Broadcom disclosed CVE-2026-59310 on July 29, 2026. The company rated the directory-traversal vulnerability Critical with a CVSS v3 score of 9.8. An attacker with network access to vCenter can exploit the flaw to execute arbitrary code. Broadcom provides patches for affected versions and lists no workaround.
The incident demonstrates why virtualization security demands the same urgency as endpoint and identity security. Compromising vCenter can place attackers dangerously close to systems controlling virtual workloads and ESXi hosts.
Incident response firm QUIRSO assessed with moderate confidence that a Chinese-speaking threat actor operated the campaign. Researchers estimated that 361 unique victim IP addresses across 47 countries had been compromised.
The analyzed vCenter exploit chain abused the vCenter Server Appliance Syslog functionality to write attacker-controlled content into privileged filesystem locations. Evidence showed a malicious cron file followed by commands that downloaded and executed the linuxFile backdoor.
The attackers did not stop after initial access. Their activity reportedly included cron jobs, systemd persistence, reverse SSH tooling, SSH keys, JSP web shells, privileged vSphere accounts, VMware directory credential-access scripts, and access to ESXi hosts.
This sequence matters because credential theft can transform a server compromise into broader infrastructure access. Attackers that obtain virtualization administrator credentials can establish additional footholds even after defenders address the original vulnerability.
In one investigated compromised environment, the intrusion ultimately led to Babuk-derived ransomware deployment on ESXi hosts. The payload encrypted files using the .babyk extension, which researchers associated with Babuk-derived ransomware. QUIRSO did not establish that the attackers deployed ransomware across other compromised environments, so the finding should not be interpreted as an automatic outcome of CVE-2026-59310 exploitation.
Why Virtualization Security Must Extend Beyond the Hypervisor
Virtualization management systems represent high-value administrative infrastructure. Defenders therefore need to investigate both the vulnerable platform and the endpoints administrators use to manage it.
Patching remains the immediate priority. Broadcom lists patched vCenter releases for affected branches, including vCenter 9.1.0.0300, 9.0.2.0100, 8.0 U3k, and 8.0 U2f. Organizations should identify their deployed version and follow Broadcom’s applicable remediation guidance.
Security teams should also review newly created privileged accounts, unexpected cron or systemd entries, suspicious SSH keys, unusual vSphere API activity, web shells, credential-access behavior, and unexpected ESXi administrative access.
Featured Resource
Cybersecurity kit
Access essential cybersecurity resources to strengthen security, reduce risk, and improve cyber resilience.
Hexnode XDR strengthens the endpoint layer surrounding virtualization infrastructure by protecting supported administrator workstations used to access management consoles. It does not run directly on the Linux-based vCenter Server Appliance or ESXi hypervisors. Instead, it gives security teams endpoint telemetry, alert correlation, investigation capabilities, and response actions for threats affecting supported administrative endpoints.
Hexnode XDR automatically correlates behavioral signals and maps identified attack activity to the MITRE ATT&CK framework. Analysts can use capabilities such as the Visual Process Tree and historical endpoint event data to investigate suspicious activity on supported administrator workstations.
Hexnode XDR also provides administrator-initiated response actions such as process termination, file quarantine, and endpoint isolation. These capabilities can help teams investigate and contain endpoint threats that could compromise workstations used to administer virtualization infrastructure. They do not remediate vulnerabilities or malicious activity directly on vCenter Server Appliance or ESXi hosts.
Hexnode UEM can provide another layer of protection for supported administrator endpoints. Organizations can define device compliance requirements and integrate Hexnode UEM with Microsoft Entra Conditional Access so access to organizational resources can depend on whether a supported managed device meets required compliance criteria. Hexnode currently provides this Conditional Access compliance data for Android, iOS/iPadOS, and macOS devices.
Together, these capabilities protect the endpoint and access layer surrounding administrative infrastructure. Organizations must still patch and secure vCenter and ESXi directly using VMware/Broadcom-supported controls and remediation guidance.
FAQs
What is CVE-2026-59310?
CVE-2026-59310 is a critical directory-traversal vulnerability in VMware vCenter Server’s Syslog server. Broadcom assigned it a CVSS v3 score of 9.8 and states that an attacker with network access can exploit it to execute arbitrary code.
Was Babuk ransomware deployed in every affected organization?
No. Researchers identified Babuk-derived ransomware deployment in one investigated compromised environment. QUIRSO said available evidence did not establish whether attackers deployed the ransomware across other compromised systems.
How can organizations reduce risk after a vCenter compromise?
Organizations should patch affected vCenter versions, examine privileged accounts and persistence mechanisms, investigate credential exposure, review ESXi access, and monitor administrator endpoints for suspicious activity.
Conclusion
The CVE-2026-59310 campaign demonstrates how exploitation of a virtualization management plane can lead to persistence, credential theft, and broader infrastructure access. In one investigated compromised environment, researchers also observed Babuk-derived ransomware deployed specifically on ESXi hosts. Available evidence does not establish ransomware deployment across every environment affected by the vCenter vulnerability.
Enterprises should patch vulnerable vCenter instances immediately, investigate privileged accounts and persistence artifacts, and review ESXi access for signs of compromise. They should also protect the administrator workstations used to access virtualization management consoles. Hexnode XDR and Hexnode UEM can strengthen this endpoint layer on supported devices, while vCenter and ESXi themselves require platform-specific patching, monitoring, and remediation.
Accelerate vCenter Threat Response
Strengthen endpoint visibility, detect persistent threats, and accelerate ransomware response with Hexnode UEM and XDR.
Content writer at Hexnode. Fueled by good coffee and the occasional cat cuddle, I enjoy crafting content that informs, connects, and resonates. Nothing excites me more than knowing my words have been read, appreciated, and maybe even bookmarked.
