"While the attacker might have had prior knowledge of the vulnerability, the strong correlation between the time of disclosure and exploitation suggests the disclosure as the initial starting point for the campaign," QUIRSO said.
CVE-2026-59310: a high-severity directory-traversal in VMware vCenter
QUIRSO's investigation centers on CVE-2026-59310, a directory-traversal vulnerability in Broadcom VMware vCenter server rated CVSS 9.8. According to the company, a malicious actor with network access can exploit the flaw to execute arbitrary code on affected vCenter appliances. Broadcom issued patches for the flaw "late last month," and QUIRSO's forensic timeline places visible exploitation activity within days of the public disclosure.
What QUIRSO found: an intrusion that established persistence with reverse_ssh
QUIRSO discovered the campaign during an incident response engagement. The firm reports an attack chain that began with path traversal activity consistent with CVE-2026-59310 and proceeded to the installation of a malicious cron job on the host. That cron job deployed reverse_ssh, an open-source tool that sets up SSH connections to infrastructure controlled by an attacker, allowing outbound connections that can evade protections for incoming traffic.
Denis Szadkowski, COO and co‑founder of QUIRSO GmbH, told The Hacker News that the forensic evidence "strongly points toward CVE-2026-59310 as the initial access vector" and that the activity they investigated represents a successful compromise rather than mere exploitation attempts.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleScale and timing: 361 IPs across 47 countries, first contact on August 3
QUIRSO identified as many as 361 unique victim IP addresses across 47 countries. The greatest concentrations were in Germany, the United States, Turkey, Iran, and France. Compromised systems first established contact with attacker-controlled domains on August 3 — a date the report notes fell five days after Broadcom publicly disclosed the flaws.
QUIRSO characterized the actor as a suspected advanced persistent threat (APT) but did not attribute the campaign to a named group. The firm emphasized the temporal correlation between disclosure and exploitation as a strong indicator that the public release of details enabled or accelerated the campaign.
Reverse_ssh and persistence: why the technique matters
Reverse_ssh permits an infected host to initiate outbound SSH sessions to attacker infrastructure, a technique the report highlights because outbound connections are less likely to be blocked by controls focused on inbound traffic. QUIRSO cautioned that "the presence of reverse_ssh should not, by itself, be treated as proof of malicious activity," but added that when it appears alongside unauthorized installations, unexpected outbound connections, or execution on a vulnerable vCenter appliance, it becomes a "high-priority indicator requiring investigation."
The report also notes prior uses of reverse_ssh-like functionality: SentinelOne in April 2025 disclosed PurpleHaze, a cluster that used a Windows backdoor called GoReShell which leverages reverse_ssh features to create reverse SSH connections to attacker hosts. QUIRSO highlighted that VMware appliances have been profitable targets for some threat actors in the past, citing Chinese threat actors like UNC5174 as examples who have weaponized VMware Tools and vCenter flaws in espionage campaigns.
Defused Cyber, CVE-2026-59309 scanning, and observed fingerprinting
Separately, Defused Cyber reported a spike in scanning against VMware vCenter that it said is indicative of potential exploitation efforts targeting CVE-2026-59309 (also CVSS 9.8). The company said its honeypots logged increased fingerprinting activity — including version probes via POST /sdk/ (RetrieveServiceContent) and walks of the /websso SAML SSO flow — coinciding with Broadcom's VMSA-2026-0006 advisory on CVE-2026-59309.
QUIRSO's Szadkowski told The Hacker News there is not enough evidence at this stage to correlate the scanning activity observed against CVE-2026-59309 with the intrusion set or attacker infrastructure associated with CVE-2026-59310, underscoring that multiple, concurrent probing and exploitation efforts can appear around widely disclosed, high-severity flaws.
What this means for technologists, policymakers, and affected enterprises
- Technologists and security teams: prioritize patching of vCenter appliances with Broadcom's updates and investigate any unexpected cron jobs or outbound SSH connections; treat reverse_ssh plus unauthorized execution on vCenter as a high-priority indicator.
- Policymakers and regulators: note that high-severity disclosures can coincide with rapid exploitation and that nation-scale or persistent threat actors have previously targeted VMware appliances such as vCenter and VMware Tools, according to industry reporting cited in the investigation.
- Affected enterprises and procurement leaders: inventory exposed vCenter instances, confirm patch status against Broadcom's fixes released "late last month," and monitor for the specific fingerprinting patterns cited by Defused Cyber (POST /sdk/ RetrieveServiceContent and /websso flows).
The investigation leaves two concrete questions at the center of the record: who is operating the suspected APT, and how widely the compromise vector tied to CVE-2026-59310 has been abused beyond the 361 IPs identified by QUIRSO. For defenders the immediate next step is clear in the evidence: apply Broadcom's patches and hunt for the combination of path-traversal indicators, unauthorized cron jobs, and outbound reverse_ssh sessions that QUIRSO's forensic work has linked to successful compromise.
Source: The Hacker News, "Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access"
