Critical VMware ESXi Vulnerability Lets Attackers Gain Root and Persistent SSH Access

Key Takeaways

• A critical path traversal vulnerability (CVE-2026-59310) in VMware vCenter’s Syslog Server is being actively exploited.
• Attackers are gaining root access, establishing persistent SSH connections, and deploying ransomware on affected ESXi hosts.
• The campaign rapidly scaled, impacting 361 IP addresses across 47 countries shortly after public disclosure.
• Sectors like technology, research, education, and telecommunications are among those targeted.
• Immediate patching of vCenter systems is crucial, and organizations should implement strict network segmentation and monitoring for suspicious activity.

A rapidly unfolding cyber campaign is leveraging a critical vulnerability in VMware vCenter to achieve comprehensive control over virtualized infrastructure. Attackers are exploiting CVE-2026-59310, a severe path traversal vulnerability within the Syslog Server component, to execute arbitrary commands with root privileges without requiring prior authentication.

The speed of this campaign is particularly alarming, with widespread exploitation observed just days after the vulnerability’s public disclosure. QUIRSO GmbH said in a report that its analysis identified 361 compromised IP addresses across 47 countries. The affected organizations span critical sectors including technology, research, education, and telecommunications, highlighting the broad appeal and potential impact of targeting vCenter management systems.

QUIRSO GmbH, in a report shared with Cyber Security News (CSN), detailed an observed compromise where the initial code execution led to persistent access, new account creation, full control over ESXi hosts, and ultimately, ransomware deployment. Researchers at QUIRSO GmbH cautiously attribute the CVE-2026-59310 campaign to a Chinese-speaking threat actor, though they have not linked it to a specific known group.

The first recorded victim connection occurred on August 3rd, merely five days after VMware released its advisory. By August 5th, an astonishing 343 of the 361 identified victim IP addresses had already been compromised. This rapid timeline underscores the critical need for organizations to treat internet-facing management systems with extreme caution, moving beyond routine server security protocols.

Syslog Flaw Opens Root Access

The initial phase of the intrusion involved the creation of malformed cron files within the /etc/cron.d directory. These files, some explicitly referencing the CVE ID and Syslog service, executed commands with root privileges without any corresponding authentication events. This evidence strongly suggests that attackers exploited the Syslog path traversal vulnerability to inject malicious content into a location where the cron scheduler would then execute it.

This attack vector transforms a standard management appliance into a formidable launchpad for further malicious activities. The scheduled cron jobs were observed downloading various tools, executing shell commands, and utilizing temporary directories for staging additional payloads. This root-level access further enabled the deployment of a web shell and the establishment of password-free administrator rights for a legitimate service account, aligning with the nature of the vCenter Syslog vulnerability which facilitates remote code execution without pre-existing access.

To ensure continued access, the threat actor implemented multiple layers of persistence. A newly created system service was configured to restart a backdoor, while a series of fake tasks, deliberately named to resemble legitimate VMware processes (e.g., vmware-vpxd-stats-*), repeatedly enabled SSH access and planted an attacker-controlled SSH key in the root user’s authorized_keys file. The campaign also installed a web shell, created new vSphere administrator accounts, and extracted credentials from the local directory service.

Researchers also identified an SSH-based reverse-tunneling utility. This tool allows the compromised host to initiate an outbound connection to the attacker’s command and control server, effectively bypassing security controls designed primarily to block unsolicited inbound traffic. The presence of such a tool, alongside recurring cron activity or unexpected egress from vCenter, should trigger immediate investigation rather than being dismissed as legitimate administrative tools.

ESXi Encryption Raises Impact

Following initial compromise and network reconnaissance, the attackers proceeded to create local administrator accounts on ESXi hosts. They then uploaded a ransomware executable and associated scripts via the vSphere datastore browser. The helper scripts were designed to halt running virtual machines, encrypt VMFS volumes, and disable the VMware high-availability agent. This sequence demonstrates the potential for a single vCenter breach to escalate into a widespread outage across the virtualized environment.

The ransomware payload employed a variant derived from Babuk, encrypting data and appending a unique extension to affected files. While large VMDK files were only partially encrypted (targeting the first 512 MB), even this partial encryption can render virtual machines inoperable. It is important to note that the use of this specific ransomware family alone is not a definitive attribution, especially given other ESXi ransomware attacks that also target shared virtual disk storage.

Indicators of Compromise (IoCs)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

What You Should Do

• Immediately Patch VMware vCenter: Apply all relevant security updates for your VMware vCenter environment. There is no effective workaround for this vulnerability; patching is paramount.
• Restrict Network Access: Remove direct public exposure to vCenter management interfaces. Implement strict network segmentation and restrict administrative access to approved, internal networks only.
• Review Accounts and Permissions: Audit all user accounts, especially newly created ones, and scrutinize any changes to sudoers files for unauthorized modifications.
• Inspect Key Directories: Examine cron, service, and web application directories for any suspicious or unfamiliar files, services, or scheduled tasks. Look for the Indicators of Compromise listed above.
• Proactive Threat Hunting: Utilize available YARA rules and other threat intelligence to scan vCenter appliances for unauthorized remote access tools and backdoors. Correlate any findings with unusual outbound network connections and unexpected file or task creations.
• Incident Response Plan: If traces of compromise are found, assume the vCenter appliance and all connected ESXi hosts are compromised. Preserve all logs before attempting cleanup, rotate all exposed credentials, and initiate your organization’s incident response procedures immediately.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.