{"uuid": "e3123cf6-62f6-4d59-99fc-f4b1bffa4e1d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59310", "type": "seen", "source": "https://t.me/pphm_HackerNews/2598", "content": "\ud83d\udd34 Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access\n\nThreat actors have begun to actively exploit a recently patched critical security flaw in Broadcom VMware vCenter, according to new findings from QUIRSO.\n\nThe vulnerability in question is CVE-2026-59310 (CVSS score: 9.8), a directory-traversal vulnerability in the VMware vCenter server that a malicious actor with network access can exploit to execute arbitrary code. Patches for the flaw were released by Broadcom late last month.\n\nThe German cybersecurity company said it discovered the activity following an incident response engagement. The attack chain is said to have exhibited path traversal activity consistent with the flaw, followed by the deployment of a malicious cron job to establish persistence on the host using reverse_ssh, an open-source tool used for setting up SSH connections to threat actor-controlled infrastructure.", "creation_timestamp": "2026-08-21T23:00:05.995875Z"}