Ransomware Gangs Exploit Critical VMware vCenter Vulnerability Despite Broadcom Patch

CISA and multiple security reports say ransomware gangs are exploiting CVE-2026-59310, a critical vulnerability affecting VMware vCenter.³Backed by 3 sourcesmeterpreter.orgBleepingComputerpetri.com The flaw is described as involving vCenter’s Syslog server, with reporting characterizing it as a path-traversal vulnerability and other coverage describing it as a remote-code-execution issue.¹Backed by 1 sourcessafeguard.sh

Broadcom released a patch for the vulnerability in late July, with one report specifying July 29, but vulnerable systems remain exposed because organizations have not all applied it.²Backed by 2 sourcesmeterpreter.orgpetri.com The reported shift from earlier exploitation for persistence to ransomware activity increases the potential impact for organizations running affected vCenter systems.¹Backed by 1 sourcespetri.com