CISA warns VMware vCenter bug now exploited in ransomware campaigns

September 16, 2026 at 12:13 AM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

CISA warned on Sept. 14 that a VMware vCenter directory traversal bug patched July 29 is now under attack by ransomware groups. The vulnerability, tracked as CVE-2026-59310 with CVSS 9.8, moved from patch to ransomware deployment in about seven weeks. Security researchers say the compressed timeline signals AI-assisted exploit development and demands immediate patching.

Key Facts

CISA warned on Sept. 14 that CVE-2026-59310, a VMware vCenter directory traversal bug with CVSS 9.8, is under active ransomware exploitation.
Broadcom patched the vulnerability on July 29, and Quirso confirmed active exploitation by Aug. 3.
Ransomware operators are deploying Babuk-derived payloads to encrypt ESXi virtual machines.
Early exploitation activity involved reverse SSH tunnels for persistence and quiet access across 47 countries.
Security researchers John Strand and Denis Calderone say the five-day patch-to-exploit and six-week exploit-to-ransomware timeline indicates AI-assisted exploit development.

Exploitation Timeline

Broadcom released a patch for CVE-2026-59310 on July 29. Quirso confirmed active exploitation by Aug. 3, five days after the patch. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog a few days later. Ransomware deployment began approximately six weeks after exploitation, around mid-September.

Attack Methods

Early activity involved reverse SSH tunnels for persistence and quiet access across 47 countries. Ransomware operators now end the attack chain with Babuk-derived payloads encrypting ESXi virtual machines. The vulnerability requires no authentication, but attackers need network access to affected vCenter services. Lydia Zhang of Ridge Security recommends restricting management interfaces to trusted networks and administrator jump hosts.

Security Response

John Strand of Black Hills Information Security says the incident 'screams' AI-assisted exploit development. Strand urges organizations to increase their tolerance for immediate patching, bypassing traditional staging and testing. He also advises placing services that only employees need behind VPNs, Cloudflare, or other private access technologies. Denis Calderone of Suzu Labs warns that organizations treating patching as a next-maintenance-cycle activity are getting caught in the compressed window.