Critical VMware vCenter RCE flaw exploited for reverse SSH access

Active exploitation of CVE-2026-59310, a critical unauthenticated RCE in the VMware vCenter Syslog Server (patched recently), is underway. Threat actors are using it to deploy a reverse SSH client, establishing persistent, outbound access to their C2 infrastructure.

Technical Breakdown

• CVE: CVE-2026-59310 (CVSS 9.8)
• Attack Vector: Unauthenticated remote code execution via the Syslog service (port 514/TCP or UDP).
• TTPs (MITRE):
  • Initial Access (T1190): Exploit Public-Facing Application.
  • Persistence (T1098): Reverse SSH tunnel ensures persistent access even if the initial vector is patched later.
  • Command and Control (T1572): Protocol Tunneling via SSH.
• IOCs: No specific IPs or hashes provided in the report; monitor for outbound SSH connections (port 22/TCP) from vCenter servers to unknown external hosts.

Defense

• Immediate: Apply the VMware vCenter update (version 8.0 U3b or later) if you haven't already.
• Detection: Hunt for sshd processes initiated by the vpxd or vmsyslog service, or unexpected outbound SSH connections from your vCenter management network.

Source: https://www.bleepingcomputer.com/news/security/critical-vmware-vcenter-rce-flaw-exploited-for-reverse-ssh-access/