Broadcom patched CVE-2026-59310 on July 29, 2026. Attackers were exploiting it by August 3 five days later. By August 5, incident response firm Quirso had documented over 340 victim IP addresses connecting to attacker infrastructure across 47 countries. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on August 18 and issued a federal patch deadline of August 21, three days, the tightest deadline CISA issues. In practice, the VMware vCenter CVE-2026-59310 ransomware activity hitting MENA is a critical vCenter compromise path that lets unauthenticated attackers execute code remotely and deploy Babuk-derived ransomware directly on ESXi datastores.
CVE-2026-59310 is a CVSS 9.8 directory traversal vulnerability in the VMware vCenter Syslog service. An unauthenticated attacker with network access to vCenter can send a crafted request to achieve arbitrary code execution with no credentials required. Once vCenter is compromised, the attacker controls the management plane for every ESXi host it manages, which is why ESXi ransomware is especially dangerous: ransomware can be deployed directly on datastores at the hypervisor layer, below the guest operating systems and below the endpoint detection tools running inside them.
For enterprises, government agencies, financial institutions, and technology organizations across Lebanon, the UAE, Saudi Arabia, and Nigeria that have virtualized their infrastructure on VMware, this is a business continuity and detection problem, not just a patching story. The analysis below breaks down the CVE-2026-59310 exploitation timeline, the sectors affected in MENA, how attackers deploy ransomware through vCenter at the hypervisor layer, and what defenders need to monitor in the SOC beyond guest-level tools to detect and contain it.
The Syslog service in VMware vCenter handles log forwarding for the vCenter appliance. CVE-2026-59310 is a directory traversal flaw in that service: a specially crafted request traverses outside the expected file path boundary and reaches the code execution path. The result is unauthenticated remote code execution on the vCenter appliance giving the attacker administrative control over the VMware management infrastructure.
vCenter is not a workload it is the orchestration layer. An attacker who controls vCenter can: create new virtual machines and snapshot existing ones, modify ESXi host configurations and networking, access the datastores on which all virtual machine disk images are stored, and deploy code directly on ESXi hosts through vCenter's management interfaces. None of these actions require touching the guest operating systems, the applications running on them, or the endpoint security tools deployed inside them.
This is why ESXi ransomware campaigns have become the preferred approach for sophisticated ransomware groups targeting enterprise virtualized infrastructure. Babuk-derived ransomware deployed directly on an ESXi datastore encrypts every virtual machine disk image stored there simultaneously without triggering a single EDR alert on any of the affected guest workloads, because the encryption happens at the storage layer, not inside the guests. The first indication that anything has happened is when every virtual machine on the datastore fails to boot.
CVE-2026-59310 is an actively exploited critical vulnerability in VMware vCenter Server and vCenter Server Appliance, and its exploitation timeline illustrates a pattern that MENA security teams need to build their detection posture around: the gap between patch release and active exploitation is measured in days, not weeks. Broadcom released the patch on July 29 and rated the issue CVSS 9.8, reflecting network-reachable exposure and low attack complexity. Exploitation began on August 3. Mass scanning of unpatched vCenter instances peaked between August 3 and August 5, with Quirso documenting the geographic spread of victim infrastructure within 72 hours of exploitation beginning. Affected products and affected versions should be moved to fixed versions immediately because no official workaround exists for CVE-2026-59310.
Organizations that patch on a monthly cycle or that treat VMware vCenter as infrastructure requiring change management approval before emergency patching faced a window of exposure during which they were being actively targeted. The attackers did not wait for a convenient patching window. The threat actor deploying reverse_ssh for persistent access was establishing footholds before most organizations had assessed the advisory, and exploitation accelerated after public disclosure, increasing the need to watch for suspicious activity during the exposure window.
Banks and financial institutions across the UAE, Lebanon, and Nigeria that have consolidated workloads onto VMware vSphere infrastructure face specific exposure to ESXi ransomware campaigns. A vCenter compromise gives ransomware operators access to every virtualized workload in the environment core banking systems, payment processing infrastructure, document management systems, and compliance archives simultaneously, creating severe business impact through parallel disruption across affected systems. CBUAE and CBN cybersecurity frameworks both require that financial institutions maintain business continuity capabilities proportionate to the risk of their infrastructure; ESXi ransomware is specifically the attack scenario that destroys business continuity at the hypervisor layer, below where continuity controls operate. In a VMware environment, compromise of the management plane can also cascade into other systems managed through vCenter, not just individual virtual machines.
Government agencies in the UAE and Saudi Arabia that have digitized operations on VMware infrastructure face exposure to both the espionage-oriented threat clusters documented by Quirso (which included a China-nexus APT) and the ransomware affiliate campaigns that followed. NCA ECC in Saudi Arabia and NESA in the UAE both require that organizations maintain monitoring capabilities that detect unauthorized access to critical systems with vCenter explicitly qualifying as critical infrastructure management given its control over every virtualized workload. Even where unauthenticated RCE is possible, network segmentation reduces exposure by limiting which hosts can reach vCenter Server.
Technology companies and large enterprises that use VMware vSphere as their primary virtualization platform across the MENA region carry concentrated risk wherever vCenter is accessible from networks that could be compromised through phishing, RMM tool abuse, or other initial access techniques, because exploitation of VMware vCenter RCE does not require exposure to the public internet and an actor with network access or a malicious actor with network reach through internal routes can still trigger it. That also puts remote access paths such as management VPNs into the vCenter Server risk model.
Guest-level endpoint detection has no visibility into what happens at the VMware management layer or on ESXi hosts directly. SHELT's SOC-as-a-Service monitors the infrastructure layer that remains visible even when guest workloads are encrypted:
Patching closes CVE-2026-59310 to future exploitation. Given that active exploitation began five days after patch release and 340+ victim IPs were documented within 72 hours, organizations that patched after August 5 should conduct a retrospective review of vCenter access logs, administrative account changes, and ESXi host configuration modifications during the exposure window, as patched systems may still contain persistence mechanisms established before remediation. The reverse_ssh persistence mechanism documented in active exploitation can survive a vCenter patch if the attacker established persistence before the update was applied.
Teams should also hunt for cron jobs, a custom systemd service, any malformed cron file, and unauthorized local accounts created to maintain access.
Review outbound network connections for suspicious activity and use YARA rules to detect reverse SSH client builds on the vCenter Server Appliance.
The attack vector requires network access to the vCenter management interface, so the risk remains even when vCenter Server is not exposed to the public internet. An actor with network access can still reach vCenter through internal footholds or management VPNs after phishing, RMM tool abuse, or credential theft. The exploitation campaign documented by Quirso used vCenter instances that were reachable from compromised internal hosts, not exclusively internet-exposed management consoles. Network segmentation can reduce exposure to CVE-2026-59310 by restricting which internal systems can reach vCenter Server.
Standard ransomware encrypts files inside guest operating systems, where backup agents, file monitoring, and recovery tools operate. ESXi ransomware encrypts the virtual machine disk images at the datastore layer outside the guest OS, below backup agents running inside VMs, and in a format that requires hypervisor-level access to restore. Recovery requires restoring entire virtual machine disk images from offline or immutable backups rather than restoring individual files, which significantly increases recovery time and makes partial recovery much harder. Organizations that back up using guest-agent-based solutions may find their backups inaccessible if the backup infrastructure was also virtualized on the compromised vCenter.
.png)
© SHELT 2023 Privacy Policy | Terms & Conditions
.png){kind=small}
