Broadcom fixed one critical VMware flaw seven weeks before ransomware arrived.
Sergiu Gatlan reported the exploitation for BleepingComputer on 15 September.
CVE-2026-59310 is a critical directory traversal in the vCenter Syslog server that unauthenticated attackers can use to run code.
Broadcom released the fix on 29 July and told customers to treat it as "an emergency" and to "install patches as soon as possible".
CISA added the flaw to its Known Exploited Vulnerabilities catalog on 18 August, giving federal agencies three days to patch. Over the weekend, the agency updated the entry to flag active exploitation by ransomware gangs.
Forensics firm QUIRSO identified more than 361 compromised IP addresses across 47 countries before the ransomware activity appeared. It also reported that a suspected state actor had left behind a reverse SSH tool for persistence.
Shadowserver counts more than 450 vCenter servers exposed online.
CISA has now tagged 26 VMware vulnerabilities as exploited in five years. Nine were used by ransomware operations, according to the agency. Control of vCenter can give an attacker an administrative path to the virtual machines it manages.
Seven weeks after a vendor calls a patch an emergency, what is still unpatched in your estate?
Sources
Our file on Broadcom
- 17 Sept
Broadcom raised VMware prices by 10x or more, European cloud providers say.
- 10 Sept
VMware pulled the toolkit rivals used to move customers off it. Without notice.
For your next steering committee
- 1Ask when systems of this kind in your landscape were last patched, and who confirms it.
- 2Ask which finance and ERP accounts can be reached from outside, and how each sign-in is protected.
- 3Ask how long a restore took the last time it was tested.
Issue 01 of the ERP LEADERS brief puts a timeline, the three-number review and six questions on one page. Read issue 01
Welcome back. · Issue 01