CISA marked vCenter CVE-2026-59310 as ransomware. Patching without hunting the appliance is not remediation.

Unauthenticated Syslog path traversal, CVSS 9.8, no workaround. CISA flipped known ransomware use to Known after the August due date. Reverse SSH was already the persistence story.

RWP Ventures · 2026-09-16 · event 2026-09-13 · 12 min read · priority 8.7

The bug is older than the flag. Broadcom advisory VMSA-2026-0006 (current revision .2, updated 19 August) describes a directory traversal in the vCenter Syslog server. CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). CWE-22. A malicious actor with network access to vCenter can execute arbitrary code. No workarounds. Fixed trains: 9.1.0.0300, 9.0.2.0100, 8.0 U3k or 8.0 U2f depending on the 8.0 branch. vSphere 7.0 is extended-support only.

The operational sentence is the asset, not the CVSS. vCenter is the control plane for the hypervisor estate. Unauthenticated RCE on that appliance is not a guest-OS story and it is not an ESXi encryptor story, even though those often follow. Patching a box that already took a reverse SSH implant in August, then declaring the KEV row closed, is how you hand the same cluster to a ransomware affiliate in September.

What happened

Broadcom published VMSA-2026-0006 on 29 July 2026. CVE-2026-59310 sits in the Syslog server. The sibling, CVE-2026-59309, is an authentication bypass in VMware Directory Service, same 9.8 vector, not on KEV. Do not collapse them. CVE-2026-47876 is a VMXNET3 host escape from a guest admin; also not on KEV. Today’s row is 59310.

QUIRSO GmbH, writing from incident response, reported that internet-accessible vCenter systems began connecting to attacker infrastructure on 3 August — five calendar days after disclosure — and that by 5 August 343 of 361 identified victim IP addresses across 47 countries had appeared. Persistence was reverse SSH (reverse_ssh, the open-source connect-back framework). QUIRSO’s follow-up assessed a suspected Chinese-nexus APT and a possible relationship to 59309. That attribution is QUIRSO’s. CISA has not adopted it. The ransomware-use flag is a separate CISA statement and does not name that cluster.

CISA added 59310 to KEV on 18 August with three other rows (Microsoft IKE, SharePoint, Apple macOS). NVD last-modified 19 August. English coverage of the ransomware flip landed 15 September (BleepingComputer, 08:16). That is after [yesterday’s Daily Top](/posts/2026-09-15-cisco-seg-cve-2026-76461-sqli/) had already shipped. The live JSON feed still carries catalog version 2026.09.14; the 59310 object now reads knownRansomwareCampaignUse: Known and forensicTriage: Yes. CISA did not publish a new “adds N vulnerabilities” alert for the field change.

BleepingComputer, citing Shadowserver, reported over 450 vCenter instances still visible on the internet. That is not a census of unpatched hosts and not a census of victims.

Why it matters

Three facts should not be collapsed.

First: PR:N on vCenter is the management plane, not a VM. FMC [CVE-2026-20079](/posts/2026-09-10-cisco-fmc-cve-2026-20079-exploitation/) was unauthenticated root on the firewall manager if you could reach the web interface. SEG [CVE-2026-76461](/posts/2026-09-15-cisco-seg-cve-2026-76461-sqli/) is unauthenticated root on the mail parser. vCenter is the third control-plane class this month: the appliance that clones disks, pushes host configs, and holds SSO. Network access in Broadcom’s wording is not “the guest OS can reach it.” It is “the attacker can reach the vCenter interface that should never have been on the internet, and in too many estates still is.”

Second: the August due date does not retire the row. FCEB’s three-day BOD 26-04 clock ended 21 August. Private-sector vCenter is not FCEB. Forensic triage is still Yes. A build string of 9.1.0.0300 proves the current image is patched. It does not prove the prior image was clean. QUIRSO’s persistence was an outbound SSH channel. Outbound from a management appliance bypasses the inbound ACLs operators cite as compensation. CISA has not published IoCs for the ransomware use. Absence of a published family is not absence of encryption risk.

Third: ransomware on vCenter is not confirmed OT impact. CenterPoint Energy’s 14 September 8-K is a customer-data incident on an external-facing system; the company said electricity and gas delivery were undisrupted. Do not staple that filing to this CVE. A vCenter that happens to host a historian, an engineering workstation farm, or a jump jump-box is still an IT compromise of virtualization at an industrial organization until someone produces process evidence. We do not have it.

Who / what is affected

Technical context

RWP is not reproducing a Syslog traversal payload. Broadcom’s public description is enough for a defender: the Syslog server failed to confine path elements (CWE-22); an unauthenticated caller with network reach to vCenter can turn that into code execution. There is no workaround. The FAQ Broadcom published at disclosure told customers to treat the fix as an emergency. That sentence aged into KEV, then into ransomware-Known.

Do not hunt 59309 playbooks and call 59310 closed. 59309 is authentication bypass in the directory service. 59310 is traversal in Syslog. Same advisory, same patch trains, different bug, different KEV status.

QUIRSO’s published post-exploitation is reverse SSH, not an ESXi locker. reverse_ssh is dual-use. Presence of the binary is an investigative lead, not proof. Combined with an unpatched or recently patched internet-facing vCenter, unexpected outbound SSH or non-standard ports from the appliance, or unauthorized service installation, it is a compromise hypothesis that BOD 26-04 forensic triage already required in August.

ATT&CK mapping for what is stated:

• Initial access: exploit public-facing application on vCenter (T1190).
• Execution: arbitrary code on the appliance (T1059), reached through path traversal (CWE-22).
• Command and control / persistence, reported by QUIRSO: protocol tunneling / remote services via reverse SSH (T1572 / T1021.004).
• Impact, CISA-confirmed as a class: ransomware campaign use. No public locker name, no public encryptor sample tied to 59310.

Follow-on that is not claimed here: named C2 infrastructure (QUIRSO withheld IoCs pending law-enforcement coordination), a named ransomware brand, lateral movement into OT, or identity of 59310 with BrickStorm (that was a different vSphere tradecraft, already covered as historical backfill).

Threat / exploitation status

High confidence on: CVE identifier, CVSS vector, product and fixed-version matrix, absence of workarounds, KEV dates, forensic-triage flag, ransomware-use field now Known, distinctness from 59309 and 47876. Moderate confidence that internet-exposed unpatched 8.0/9.0/9.1 appliances remain the practical target set (fixed releases exist; Shadowserver is visibility, not patch state). Low confidence on ransomware family, current victim count, and whether a patched appliance still hosts the August reverse-SSH implant.

What defenders should do

1. Inventory every vCenter you actually run — 9.1, 9.0, 8.0 U2/U3, VCF/vSphere Foundation, Telco Cloud, lab, DR, and the “temporary” internet jump. Record build. If it answers on 443 from a network that is not the management VLAN, treat it as exposed until the ACL is proven off-box.

1. Hunt before you close the ticket. Forensic triage is Yes, still. Appliance shell history, unexpected binaries, crontab/systemd units, authorized_keys, and outbound SSH or unknown ports from the vCenter IP. QUIRSO’s published persistence is reverse SSH; CISA has not printed ransomware IoCs. Preserve logs and snapshots before you replace the VM. A new VCSA with a clean build destroys the disk you needed.

1. Patch to the VMSA matrix. 9.1 → 9.1.0.0300. 9.0 → 9.0.2.0100. 8.0 → U3k or U2f for the branch you are on. VCF 5.x → async to 8.0 U3k. Telco → KB449886. 7.0 → Broadcom support if you still have extended coverage; otherwise isolate. There is no workaround to hide behind.

1. If exploitation is suspected: isolate management interfaces, rotate vCenter SSO and service accounts, rotate any credentials stored in or retrieved from the appliance, rebuild from a fixed image rather than “upgrade in place and hope,” and treat connected ESXi hosts as in-scope for integrity checks. Do not confuse a patched build with eradication.

1. Do not skip 59309 because it is not on KEV. Same trains. Auth bypass is a second unauthenticated door on the same box. 47876 is an ESX host problem, not a vCenter problem; patch ESX on its own matrix.

1. Sequence the rest of this week’s clock. [Cisco SEG CVE-2026-76461](/posts/2026-09-15-cisco-seg-cve-2026-76461-sqli/) is KEV-due 17 September, forensic triage Yes, no workaround — that clock is still live. LiteLLM CVE-2026-59822 and Starlette CVE-2026-48710 were due 16 September. [ScreenConnect CVE-2026-84869](/posts/2026-09-14-screenconnect-cve-2026-84869-kev/) and [GitLab CVE-2026-85706](/posts/2026-09-12-gitlab-cve-2026-85706-path-traversal/) are overdue. Artifactory CVE-2026-42016 / 42018 due 25 September. [Check Point CVE-2026-85102 / 85103](/posts/2026-09-13-checkpoint-vpn-cve-2026-85102-85103/) are still not on KEV as of 2026.09.14.

This is not an exploitation guide. Use Broadcom’s advisory and off-box logs.

RWP assessment

Score 8.7. Unauthenticated RCE on the hypervisor control plane, KEV’d since 18 August with forensic triage, and now CISA-confirmed ransomware-campaign use — that is the first material development after [yesterday’s SEG SQLi](/posts/2026-09-15-cisco-seg-cve-2026-76461-sqli/). RWP had not published 59310 as a Daily Top. The ransomware field change is what moved overnight. English reporting of that change landed 15 September at 08:16, after yesterday’s 06:00 run.

It does not outrank yesterday’s 76461 on urgency of the federal clock. SEG is due tomorrow. 59310’s federal clock expired in August. It outranks 76461 on blast radius: a mail gateway is mail; vCenter is every VM the appliance can touch. It outranks WSO2 CVE-2026-5430 (watchTowr honeypot JWT forgeries from 13 September, CVSS 10, not on KEV). Honeypot attempts against an API manager are real. They are not a CISA ransomware flag on the virtualization control plane.

It outranks Google Pixel CVE-2026-58704 (adjacent-network modem EoP; Pixel bulletin High; limited-targeted claims in secondary reporting), Acronis CVE-2026-87886 (Linux LPE in a cPanel backup plugin; vendor says limited targeted attacks against cPanel/WHM, based on a single customer report), Oracle’s 15 September CSPU (673 patches, 104 critical, no exploited CVE named), and the 15 September CISA ICS batch (Schneider SCADAPack, Siemens Reyrolle 7SR5 / Teamcenter / Mendix, Wärtsilä FOS-Onboard, mySCADA — no exploitation claimed). CenterPoint’s customer-data 8-K is a utility IT incident, not this CVE and not a process event.

Sunday-into-Tuesday KEV catalog version is still 2026.09.14. No new CVE row. One old row just became ransomware.

What we are watching

• Whether CISA or a vendor names a ransomware family, publishes IoCs, or flips any other August vSphere CVE.
• Whether 59309 or 47876 lands on KEV.
• Whether QUIRSO, Broadcom, or a national CERT releases the withheld C2 set.
• Internet-exposed vCenter counts versus patched-build evidence, not just Shadowserver banners.
• WSO2 CVE-2026-5430: watchTowr captured admin-privilege JWTs on 13 September; not on KEV as of 2026.09.14.
• Cisco SEG 76461 through 17 September.
• Any attempt to treat a vCenter compromise at an industrial tenant, or CenterPoint’s IT data incident, as an OT event without process evidence.

Sources

• CISA Known Exploited Vulnerabilities Catalog — CVE-2026-59310
• CISA KEV JSON feed
• CISA — Adds Four Known Exploited Vulnerabilities to Catalog (18 August 2026)
• CISA — BOD 26-04
• Broadcom — VMSA-2026-0006.2
• CVE.org — CVE-2026-59310
• NVD — CVE-2026-59310
• QUIRSO — Active exploitation of CVE-2026-59310: 361 victim IPs across 47 countries
• QUIRSO — Global exploitation of CVE-2026-59310 by suspected Chinese-nexus APT
• BleepingComputer — CISA: Critical VMware RCE flaw now exploited by ransomware gangs (15 September 2026)
• SecurityWeek — Critical VMware vCenter Vulnerability in Attackers' Crosshairs (13 August 2026)
• NHS England — CC-4821 Broadcom security update
• [RWP Daily Top, 15 September 2026 — Cisco SEG CVE-2026-76461](/posts/2026-09-15-cisco-seg-cve-2026-76461-sqli/)
• [RWP Daily Top, 14 September 2026 — ScreenConnect CVE-2026-84869](/posts/2026-09-14-screenconnect-cve-2026-84869-kev/)
• [RWP Daily Top, 13 September 2026 — Check Point CVE-2026-85102 / 85103](/posts/2026-09-13-checkpoint-vpn-cve-2026-85102-85103/)
• [RWP Daily Top, 12 September 2026 — GitLab CVE-2026-85706](/posts/2026-09-12-gitlab-cve-2026-85706-path-traversal/)
• [RWP Daily Top, 10 September 2026 — Cisco FMC CVE-2026-20079](/posts/2026-09-10-cisco-fmc-cve-2026-20079-exploitation/)