VMware’s 9.8-Severity Flaw: How 361 Servers Fell in 9 Days After Patch Day

Three Critical Flaws, One Emergency Patch

On July 29, 2026, Broadcom disclosed and patched three critical vulnerabilities affecting core VMware virtualization products. CVE-2026-59309, an authentication bypass in vCenter, and CVE-2026-59310, a directory-traversal flaw enabling arbitrary code execution, both carry the maximum-severity CVSS score of 9.8. A third flaw, CVE-2026-47876, an out-of-bounds write in the VMXNET3 virtual network adapter with a 9.3 CVSS score, allows an attacker with local administrative privileges inside a virtual machine to execute code directly on the host ESXi server — a VM-escape scenario that undermines the core isolation promise of virtualization itself.

All three vulnerabilities affect current, actively supported versions: vCenter 8.0 and Cloud Foundation/vSphere Foundation 9.0.x and 9.1.x for the two vCenter flaws, and ESXi 8.0, 9.0.x, and 9.1.x for the VMXNET3 flaw, according to Rapid7’s technical writeup. Fixed versions were released simultaneously with the disclosure: vCenter 9.1.0.0300, vCenter 9.0.2.0100, vCenter 8.0 U3k or 8.0 U2f, and corresponding ESXi builds.

No Workaround Means No Excuse to Wait

The detail that should have alarmed every VMware administrator on July 29 is not the CVSS score alone — critical-severity CVEs are unfortunately routine — but the absence of any mitigation short of patching. Rapid7’s advisory states plainly that “there are no workarounds for CVE-2026-59309 or CVE-2026-59310, making vendor-provided updates the primary remediation.” There was no firewall rule, no configuration change, no compensating control available to organizations that could not immediately patch — only the update itself.

Rapid7 also flagged the specific historical reason vCenter deserved urgent attention even before exploitation began: the product had appeared on CISA’s Known Exploited Vulnerabilities (KEV) list ten times previously for other vulnerabilities — meaning attackers have a well-established pattern of prioritizing vCenter once a new critical flaw becomes public. Rapid7’s advisory urged customers to “patch on an urgent basis before exploitation in-the-wild occurs” — a recommendation that, in retrospect, undersold how little time organizations actually had.

From Patch to Active Campaign in Five Days

The gap between disclosure and exploitation was short. According to SecurityWeek’s reporting, active exploitation of CVE-2026-59310 began August 3, 2026 — just five days after Broadcom’s July 29 patch release. From there, the compromise count climbed quickly: BleepingComputer’s tracking showed the first compromised systems connecting to attacker infrastructure on August 3, followed by 151 newly observed victim IPs by August 4, 343 IPs by August 5, and a total of 361 IP addresses across 47 countries by August 7.

Germany, the United States, Turkey, Iran, and France accounted for over half of all identified victims, per BleepingComputer’s reporting. Security researcher group Quirso, cited by SecurityWeek, offered a specific read on the timing: “while the attacker might have had prior knowledge of the vulnerability, the strong correlation between disclosure and exploitation suggests disclosure as the initial starting point for the campaign” — in other words, the patch notes and CVE details themselves likely functioned as the attacker’s roadmap.

The Payload: A Reverse Shell Built to Dodge Firewalls

Once inside a vulnerable vCenter Syslog server, attackers deployed reverse_ssh, an open-source reverse SSH shell framework, to establish persistence. The tool’s specific value to the attackers is architectural: because it initiates an outbound connection from the compromised server back to attacker-controlled infrastructure, rather than requiring the attacker to connect inbound, it functions as a command-and-control channel that can bypass standard inbound firewall rules and other network security controls that assume attackers need to reach in, not that compromised machines will reach out.

Quirso released a generic YARA detection rule for reverse_ssh binaries via its public GitHub repository, giving defenders a way to hunt for the specific payload even without knowing whether their own vCenter instance had already been compromised. Researchers told SecurityWeek they suspected advanced persistent threat (APT) involvement in the campaign but withheld specific attribution indicators pending law enforcement coordination — a common pattern when investigators believe premature disclosure could compromise an active investigation or tip off the threat actor.

What This Means for Enterprises Running VMware Infrastructure

1. Treat “no workaround available” advisories as an automatic Tier-1 emergency

When a vendor advisory explicitly states no mitigation exists short of patching, standard change-management timelines should be overridden. Organizations should have a pre-approved emergency-patch process specifically for this advisory category — no workaround, critical CVSS, internet-facing management infrastructure — that can execute within the 5-day window this campaign demonstrated is realistic for attacker weaponization.

2. Audit whether your vCenter Syslog server is internet-facing at all

CVE-2026-59310 specifically affects the vCenter Syslog server component, and the exploitation pattern targeted network-accessible instances. Enterprises should verify their vCenter management infrastructure — including Syslog server functionality — is not exposed to the public internet, since the underlying design assumption of vCenter is that it sits on a trusted management network, not a public-facing one.

3. Deploy the reverse_ssh YARA rule regardless of your patch status

Even organizations that patched promptly should run Quirso’s published YARA detection rule against their environment, since the 5-day exploitation window means any instance left unpatched between July 29 and early August could have been compromised before remediation. Patching closes the vulnerability going forward; it does not remove a payload already deployed during the exposure window.

4. Monitor outbound connections from management infrastructure, not just inbound

The reverse_ssh tool’s core evasion technique — outbound-initiated connections — defeats security postures built primarily around inbound filtering. Security teams should specifically review egress monitoring and alerting for vCenter and other virtualization management servers, since these systems rarely need to initiate outbound SSH connections to external hosts under normal operation, making such connections a high-value detection signal.

A Pattern Vendors and Defenders Both Recognize

This incident fits a now-familiar shape in enterprise security: a maximum-severity flaw in widely deployed infrastructure software, no workaround, and a compromise timeline measured in single-digit days rather than weeks. What distinguishes this case is the specificity of the evidence — a documented five-day gap between patch and first exploitation, a precise IP and country count tracked day by day, and a named, fingerprinted payload with a public detection rule already available. For CISOs managing virtualization infrastructure, the practical lesson is not “patch VMware” in the abstract, but a concrete benchmark: if a CVSS 9.8, no-workaround vCenter advisory can go from disclosure to 361 compromised servers in nine days, any organization’s patch cycle needs to be measured against that clock, not against internal change-management convenience.

Frequently Asked Questions

Sources & Further Reading

• Critical VMware vCenter Vulnerabilities Allow Authentication Bypass and Remote Code Execution — Rapid7
• Critical VMware vCenter RCE flaw exploited for reverse SSH access — BleepingComputer
• Critical VMware vCenter Vulnerability in Attackers’ Crosshairs — SecurityWeek
• Three Critical VMware Flaws Allow Auth Bypass, Code Execution, and VM Escape — The Hacker News