CISA Warns Ransomware Gangs Now Exploiting Critical VMware vCenter Flaw

CISA confirmed on September 15, 2026 that ransomware gangs have joined an already active espionage campaign targeting CVE-2026-59310, a critical VMware vCenter vulnerability with a CVSS score of 9.8 that allows unauthenticated remote code execution.

How the Flaw Is Exploited

The vulnerability lets an unauthenticated attacker with network access to a vCenter instance execute arbitrary code through the Syslog server component — no valid credentials required, making any unpatched, internet-facing vCenter instance a direct target.

A Patch That Arrived Weeks Before Most Applied It

Broadcom patched the bug on July 29, 2026, but the fix arrived weeks before most administrators applied it — a gap attackers exploited during. A DFIR firm later found over 361 compromised IPs across 47 countries linked to a suspected APT that had been deploying reverse SSH tools to establish persistent access, well before ransomware operators joined the exploitation.

From Espionage to Ransomware

CISA says ransomware operators are now exploiting the flaw after earlier activity focused specifically on establishing persistence — a pattern where an initial espionage-motivated actor's access is later joined, or the same access is monetized, by financially-motivated ransomware groups, extending the real-world impact of an unpatched vulnerability well beyond its original threat actor.

CISA's Recommended Actions

• Immediately apply the available security updates from Broadcom
• Review all internet-facing vCenter instances specifically
• Verify that systems have not already been compromised, rather than assuming patching alone resolves prior unauthorized access

What This Means for Virtualization Infrastructure Operators

A nearly seven-week gap between patch release and CISA's ransomware warning is a specific, concrete reminder that critical infrastructure software patches — especially for virtualization platforms sitting underneath entire data center environments — need a defined, fast-tracked patching SLA rather than following the same cadence as lower-risk software, given how much downstream infrastructure a single compromised vCenter instance can expose.