Critical VMware vCenter Directory Traversal Flaw Used in Global Attacks
Brief
Broadcom VMware vCenter administrators are facing an intrusion campaign targeting CVE-2026-59310 , a critical directory-traversal vulnerability in the vCenter Syslog Server.
Threat researchers at QUIRSO said they identified 361 unique victim IP addresses across 47 countries, with evidence suggesting a suspected advanced persistent threat is using the flaw to obtain code execution and establish remote access.
The campaign shows attackers rapidly operationalizing weaknesses in exposed virtualization-management infrastructure. Broadcom issued advisory VMSA-2026-0006 on July 29, 2026.
Critical VMware vCenter Directory Traversal Flaw
QUIRSO observed affected systems begin connecting to attacker-controlled infrastructure on August 3 five calendar days later.