Broadcom VMware vCenter Server is affected by a critical directory traversal vulnerability, CVE-2026-59310 (CVSS 9.8), enabling unauthenticated remote code execution (RCE) via network access. An unidentified APT group is actively exploiting this flaw in a global campaign spanning 47 countries, utilizing a distributed infrastructure of 361 unique IP addresses. Because attackers may have established persistence prior to remediation, applying official vendor patches alone may not fully secure compromised environments. Full system compromise and subsequent lateral movement within virtualized infrastructure represent the primary operational risks.

• Vulnerability Mechanics: CVE-2026-59310

  • Flaw involves a directory traversal vulnerability allowing unauthorized access to restricted file paths.
  • Attackers leverage this access to achieve Remote Code Execution (RCE) with high privileges.
  • The vulnerability is network-reachable and requires no prior authentication to trigger.

• Campaign Scale and Adversary Profile

  • Attributed to an unspecified, sophisticated APT group conducting global operations.
  • Infrastructure comprises at least 361 unique IP addresses used for targeting and command-and-control (C2).
  • Active exploitation has been confirmed across 47 different countries.

• Operational Impact and Risk

  • Severity is rated Critical (CVSS 9.8) due to the potential for full system takeover.
  • Compromised vCenter servers provide a high-value pivot point for lateral movement across the entire virtualized environment.
  • High risk of deep persistence, data exfiltration, and deployment of further malicious payloads.

• Mitigation and Defensive Challenges

  • Official patches are available but may be insufficient if attackers have already established persistence.
  • Security researchers warn that patching without forensic auditing leaves environments vulnerable to existing backdoors.
  • Defenders must prioritize hunting for post-exploitation artifacts and anomalous system behavior.

• Intelligence and Detection Requirements

  • Identification of specific directory paths targeted during traversal to create high-fidelity alerts.
  • Extraction and deployment of RCE payload signatures used by the APT group.
  • Mapping of the 361 identified IP addresses to known C2 frameworks or proxy networks.
  • Forensic analysis of vCenter logs for unauthorized file access and unexpected process execution.