Ransomware gangs turn to a patched vCenter flaw, exposing the virtualisation weak spot

The US Cybersecurity and Infrastructure Security Agency has updated its catalogue of known exploited vulnerabilities to flag a critical flaw in VMware vCenter as being used in ransomware campaigns. The change, made over the weekend and reported by BleepingComputer on Monday, September 15, concerns CVE-2026-59310, a directory traversal bug in vCenter's Syslog server that lets an unauthenticated attacker run arbitrary code. Broadcom, which owns VMware, fixed it on July 29 and told customers to treat the update "as an emergency". Seven weeks later, criminal groups are using it to break into corporate networks.

The story matters beyond the security operations centre. vCenter is the management console for VMware's virtualisation platform, the layer on which a large share of corporate servers runs. Whoever controls it can, in practice, control the virtual machines beneath it. A flaw of this kind is therefore not one more bug in a long list but a potential master key, and its adoption by ransomware operators turns a technical advisory into a balance sheet risk.

What Broadcom disclosed and when

Broadcom published advisory VMSA-2026-0006 on July 29, covering five vulnerabilities across ESX, vCenter, Workstation and Fusion. Two of them sit in vCenter and both carry a CVSS score of 9.8, the top of the critical band. CVE-2026-59310 is the Syslog directory traversal; its companion, CVE-2026-59309, is an authentication bypass in the VMware Directory Service. In both cases the advisory says an attacker needs only network access to vCenter, with no privileges and no user interaction. A third flaw, CVE-2026-47876, is an out-of-bounds write in the VMXNET3 virtual network adapter of ESX, scored 9.3, which can let an administrator inside a virtual machine execute code on the host.

The advisory lists no workarounds for any of the five. Patching is the only remedy. Fixed releases include vCenter 9.1.0.0300, 9.0.2.0100 and 8.0 U3k, with 8.0 U2f also listed. Broadcom revised the advisory on August 3 and again on August 19, the second time adding patch guidance for version 7.0. For vCenter 7.0, customers are told to contact Broadcom support if they hold an extended support contract, a detail that matters for organisations still running older estates.

From quiet exploitation to ransomware

The exploitation timeline is short. About two weeks after the patch, according to BleepingComputer, the incident response firm QUIRSO reported more than 361 compromised IP addresses across 47 countries, with a suspected advanced persistent threat (APT) actor using the flaw to deploy a reverse SSH tool. CISA then added CVE-2026-59310 to its catalogue and gave US federal agencies three days to secure their vCenter systems.

The weekend update is the escalation. As Petri summarised CISA's position, early exploitation involved attackers installing persistence tools, and "ransomware groups have now joined the campaign". Neither CISA nor the press reports name the groups involved. The pattern is nevertheless familiar: a sophisticated actor finds and uses a flaw first, the details spread, and financially motivated crews follow once a working method is available.

Exposure remains real. The Shadowserver Foundation tracks more than 450 VMware vCenter servers exposed to the internet, BleepingComputer reported. That number captures only consoles reachable from the public internet; many more sit on internal networks, where an attacker who has gained a foothold by other means could reach them.

A pattern, not an accident

VMware products have become a recurring target. Over the past five years CISA has tagged 26 VMware vulnerabilities as exploited in the wild, nine of which were also used by ransomware operations. This year alone it warned in February about exploitation of CVE-2025-22225, an ESXi sandbox escape, and flagged CVE-2026-22719 in VMware Aria Operations and CVE-2024-37079 in vCenter Server as exploited in February and March.

The economics explain why. Encrypting individual laptops is slow and noisy. Encrypting the hypervisor layer can take down hundreds of servers at once, including backups that live on the same platform, which maximises pressure on the victim to pay. A flaw that grants unauthenticated access to the management console offers exactly that leverage. It also tends to be patched slowly, because virtualisation updates require maintenance windows and careful testing on systems that run everything else.

Why investors should care

For private companies, the episode is a reminder that the most consequential cyber risk is often not the novel AI threat that dominates pitch decks, but basic hygiene on infrastructure that everyone assumes is stable. Patch latency on core systems is measurable, and it belongs in due diligence alongside revenue quality and churn. A portfolio company that took seven weeks or more to apply an emergency fix to its hypervisor console has a governance problem, not merely an IT one.

The incident also sharpens the case for several categories of security startups. Tools that continuously map an organisation's internet-facing assets would have flagged an exposed vCenter console; vendors focused on immutable, isolated backups address the scenario in which attackers encrypt the virtualisation layer and the recovery copies together. Insurers, for their part, have every reason to ask about virtualisation patching specifically when they price ransomware cover.

Finally, there is a vendor concentration point. When a single management plane controls most of a company's compute, a critical flaw in that plane becomes a single point of failure. Boards weighing infrastructure strategy should treat that concentration as a risk factor in its own right, whichever platform they use.

Our view

CVE-2026-59310 is not a story about a clever new exploit. Broadcom disclosed it, rated it critical, published fixes and asked customers to act immediately. The damage now being done is the product of delay, and delay is a management choice. That is why this is a matter for boards and investors, not only for security teams.

For founders, the lesson is to know where every management console sits, who can reach it, and how quickly an emergency patch can be applied, and to be able to prove it to a buyer or an insurer. For investors, patch discipline on core infrastructure is a cheap and revealing diligence question. What to watch next: whether CISA or incident responders attribute the ransomware activity to named groups, whether victims begin to disclose incidents in regulatory filings, and whether the companion authentication bypass, CVE-2026-59309, follows the same path. If it does, the case for treating virtualisation as critical infrastructure inside every company will become impossible to ignore.

Sources

• BleepingComputer: CISA: Critical VMware vCenter RCE flaw now exploited by ransomware gangs
• Petri: Ransomware operators are exploiting a critical VMware vCenter flaw
• Broadcom: VMSA-2026-0006, VMware ESX, vCenter, Workstation and Fusion updates address multiple vulnerabilities
• OP-C: VMware vCenter CVE-2026-59310 RCE under active exploitation

Filed under Cybersecurity. Written by InvestTimes Editorial under our editorial standards. Commentary and analysis for information only, not investment advice.