CISA Confirms Ransomware Gangs Now Exploiting the Critical vCenter CVE-2026-59310 Flaw

CISA confirmed on September 15, 2026 that ransomware gangs have joined what was already an active espionage campaign against CVE-2026-59310, the critical vCenter Server directory traversal flaw patched back in July. This is a real, significant escalation: the threat moved from a single suspected nation-state actor to multiple ransomware operators actively exploiting the same unauthenticated remote code execution path. If your organization patched vCenter back in July or August and moved on, this update is worth revisiting, and if you never patched, the threat model has materially worsened since disclosure.

How this escalated, in order

CVE-2026-59310, a directory traversal vulnerability in the vCenter Syslog service allowing unauthenticated remote code execution, CVSS 9.8, was patched by Broadcom in VMSA-2026-0006 on July 29, 2026 alongside four other issues across ESX, vCenter, Workstation, and Fusion. The timeline from there moved fast: within five calendar days of public disclosure, a suspected China-nexus advanced persistent threat group began actively exploiting the flaw. By mid-August 2026, more than 361 compromised IP addresses had been identified across 47 countries, a genuinely global exploitation campaign, not an isolated incident.

Then, on September 15, CISA updated the vulnerability’s KEV catalog entry specifically to mark it as used in known ransomware campaigns. CISA’s own language shifted from describing a single suspected state-linked actor to describing multiple ransomware gangs, plural, actively exploiting the same flaw. That shift matters practically: a nation-state espionage campaign and a ransomware campaign have different objectives and different downstream consequences, ransomware operators are typically faster to monetize access through encryption and extortion once they have a foothold, meaning the window between initial compromise and serious operational impact tends to be shorter.

What to check right now, even if you think you already patched

# Confirm your current vCenter version against the actual fixed releases
# Fixed versions: vCenter 9.1.0.0300, 9.0.2.0100, or 8.0 U3k/U2f,
# with corresponding VMware Cloud Foundation updates for each track

# If you patched back in July or August, verify the patch actually
# applied successfully rather than assuming a scheduled update completed
# cleanly, confirm the running build number directly

If you’re confirmed patched to one of the fixed versions, your direct exposure to this specific CVE is closed, but given the scale of exploitation already observed (47 countries, 361+ compromised IPs before this ransomware escalation was even confirmed), it’s worth a targeted look at vCenter logs from the July-August window for any sign of compromise that occurred before your patch was applied, patching after an initial compromise doesn’t undo whatever access was already established.

If you’re still unpatched

Treat this as an active incident-response priority, not a routine patch backlog item. An unpatched, internet-reachable vCenter Server with this specific CVE is now a confirmed target for both espionage-motivated and financially-motivated (ransomware) attackers simultaneously. Patch immediately, and given the confirmed scale and duration of exploitation, seriously consider a compromise assessment on the vCenter Server and connected infrastructure rather than assuming a clean patch alone resolves the risk if the server has been internet-reachable and unpatched since July.

Why vCenter specifically is such a high-value ransomware target

vCenter Server manages the virtualization layer underneath potentially hundreds of virtual machines. Compromising vCenter itself, rather than individual VMs one at a time, gives ransomware operators a single point from which to encrypt or disrupt an entire virtualized estate at once, which is exactly the kind of high-leverage access ransomware groups specifically seek out. This is the same underlying reason domain controllers are such high-value targets in Active Directory environments, a single well-placed compromise multiplies the attacker’s reach across everything that infrastructure controls.

Frequently asked questions

We patched in early August, before this ransomware escalation was confirmed. Are we still at risk from this specific update?
The September 15 update doesn’t represent a new vulnerability, it’s confirmation that additional threat actors (ransomware gangs) are now exploiting the same already-patched CVE. If you’re confirmed on a fixed version, this specific vulnerability is closed for you, this update is primarily relevant for prioritizing a compromise check if you were unpatched during the active exploitation window before you applied the fix.

How would we know if we were compromised during the window before we patched?
Review vCenter Syslog service logs and general vCenter access logs from the relevant window for anomalous requests, particularly directory traversal patterns or unexpected service behavior, and check for any unfamiliar administrative accounts, scheduled tasks, or configuration changes that don’t match your own change history. Given the sophistication suggested by the original suspected nation-state involvement, a thorough compromise assessment may need more than a quick log review if your server was genuinely exposed during the active exploitation window.

Does patching to the fixed version protect against both the original espionage campaign and the newer ransomware activity?
Yes, both sets of actors are exploiting the same underlying CVE-2026-59310 vulnerability, patching to a fixed vCenter version closes the vulnerability itself regardless of which category of attacker is attempting to exploit it. The distinction between espionage and ransomware actors matters for understanding threat motivation and urgency, not for what the actual technical fix requires.