China-Nexus APT Exploits VMware vCenter CVSS 9.8 RCE Across 47 Countries

Marcus Chen Staff Engineer (Backend & Cloud), YuSMP Group · Backend, cloud and platform security for US and EU products

The short answer

What is CVE-2026-59310 actually is

VMware vCenter Server includes a Syslog service that accepts log data over the network. CVE-2026-59310 is a directory-traversal flaw in how that service handles incoming messages: a specially crafted request can instruct the service to write a file to an arbitrary path on the vCenter appliance's filesystem. Because the Syslog service runs as root, the attacker can write any file anywhere — including a web shell or a cron job — and then trigger it for remote code execution.

The vulnerability requires only network access to the vCenter management interface (TCP port 443). No credentials, no user interaction, and no prior foothold are needed. Broadcom assigned it the maximum practical CVSS v3 score of 9.8. The affected attack surface is large: virtually every VMware vSphere deployment has a vCenter appliance, and the management interface is frequently reachable from corporate networks that are not considered untrusted.

Broadcom published its advisory and fixed versions on July 29, 2026 — the same day it disclosed the vulnerability publicly, leaving organizations with a narrow window to patch before researcher-quality exploit details circulated.

How the attack unfolds

The post-exploitation chain documented by QUIRSO and reported by BleepingComputer and The Hacker News shows two distinct persistence mechanisms deployed after initial root access.

First, attackers create a backdoor binary they call "linuxFile" and install it as a system cron job. The cron entry ensures the backdoor relaunches after reboots or if the process is killed. Once running, linuxFile opens an outbound WebSocket connection to an attacker-controlled command-and-control server, accepting and executing shell commands. Outbound WebSocket connections are rarely blocked by corporate firewalls, making this channel hard to detect without egress inspection.

Second, the campaign deploys the open-source reverse_ssh framework, which tunnels an SSH session from the compromised vCenter appliance to the attacker's infrastructure over an outbound TCP connection. Reverse SSH is widely used in red-team tooling precisely because standard perimeter defenses block inbound connections but rarely scrutinize outbound ones from internal servers. With persistent reverse SSH access, the attacker can reach any host that vCenter can reach on the internal network — including hypervisor management interfaces (ESXi), backup systems, and domain controllers.

QUIRSO's attribution analysis identified Chinese-language strings in the attacker-created scripts, operational activity aligned with the UTC+08:00 timezone, reuse of techniques documented in Chinese-language security research publications, and a victimology pattern that conspicuously excludes mainland China. The firm assessed the campaign operator as a China-nexus APT with moderate confidence, noting that it withheld specific threat-actor designations pending law-enforcement coordination.

Who is at risk and what to do now

Every organization running a self-managed VMware vSphere environment with an unpatched vCenter appliance is vulnerable. VMware Cloud Foundation customers are also affected. The table below covers affected versions and their corresponding fixes:

Broadcom has confirmed no workaround exists. Restricting access to the vCenter management interface (TCP port 443) to known-good management subnets reduces exposure but does not eliminate risk — most enterprise environments have broad internal network access to vCenter. Document any access-restriction measure as a compensating control in your risk register, and treat it as a temporary hold, not a resolution.

If you are unsure whether your vCenter appliance has been compromised, look for: unexpected new cron jobs on the vCenter appliance, unfamiliar processes making outbound TCP connections on non-standard ports, and binary files placed in world-writable directories. QUIRSO has released a YARA rule for identifying the reverse_ssh artifacts used in this campaign.

What it means for US & EU software teams

VMware vSphere remains the dominant virtualization platform for on-premises and private-cloud deployments across US and EU enterprise environments. Engineering organizations typically use vCenter to orchestrate the VMs running their CI/CD infrastructure, internal databases, development tooling, and staging environments — precisely the systems that hold source code, deployment credentials, and build artifacts.

Root access to a vCenter appliance translates into de facto access to every VM in that cluster. An attacker who can execute commands as root on vCenter can snapshot and exfiltrate any running VM's disk, inject into the hypervisor layer, or move laterally through the management network to Active Directory or other identity infrastructure. For teams building products that handle regulated data — payment processing, health records, personal data under GDPR — a compromised vCenter is a reportable incident regardless of whether the attacker touched application-layer data directly.

The five-day patch-to-exploit timeline is significant context. Security teams operating under change-freeze policies or long change-advisory processes will find that the standard 30-day patching SLA for critical vulnerabilities is entirely inadequate for CVSS 9.8 flaws that attract state-level threat actors. For software teams evaluating their infrastructure strategy, this campaign reinforces the risk argument for migrating workloads to container orchestration platforms — Kubernetes-based environments have a fundamentally different (and typically narrower) blast radius when an individual component is compromised.

EU teams operating under NIS2 are required to notify their national CSIRT of significant incidents within 24 hours of becoming aware. If your vCenter has been exposed to this vulnerability and you have any indication of compromise — unexpected processes, anomalous outbound connections, unfamiliar cron entries — that notification clock may already be running.

What to do today

1. Inventory every vCenter appliance. Shadow vCenter instances in acquired entities or isolated business units are common. You cannot patch what you cannot see — run a network scan for open port 443 with a VMware vCenter certificate signature if needed.
2. Check the version on each appliance. Log in to the vCenter management UI and check Administration → Deployment → System Configuration, or query the REST API at /api/vcenter/system/version. Any version prior to 9.1.0.0300 / 9.0.2.0100 / 8.0 U3k / 8.0 U2f is vulnerable.
3. Prioritize internet-reachable or DMZ-adjacent vCenter instances. vCenter appliances with management interfaces reachable from segments that could be reached by an external attacker should be treated as P0. Even internal-only instances should be patched this week.
4. Apply Broadcom's patches. Follow Broadcom's standard vCenter upgrade path. The patch was released July 29, 2026; any appliance still unpatched three weeks later is a priority incident.
5. Check for indicators of compromise. Review cron entries on the appliance (crontab -l as root and check /var/spool/cron), look for unusual processes making outbound connections (ss -tnp), and scan for the reverse_ssh binary using QUIRSO's published YARA rule.
6. Restrict management-network access as a temporary measure. If patching is blocked by a change freeze, restrict vCenter's management interface to a dedicated management VLAN with ACLs. Document this as a time-limited compensating control.
7. Review audit logs. Check vCenter's event log for unexpected administrative operations — VM snapshots, new user accounts, configuration changes — in the window from August 3 onward.

Frequently asked questions

Sources

BleepingComputer — Critical VMware vCenter RCE Flaw Exploited for Reverse SSH Access, August 13, 2026
The Hacker News — Suspected China-Nexus Actor Exploits VMware vCenter Flaw, August 17, 2026
SecurityWeek — Critical VMware vCenter Vulnerability in Attackers' Crosshairs, August 13, 2026