Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access

Threat actors rapidly weaponized CVE-2026-59310, a critical directory-traversal vulnerability in VMware vCenter, exploiting it almost immediately after Broadcom released the patch — a pattern known as 'patch-gap exploitation.' The flaw enables arbitrary code execution, giving attackers a foothold to deploy persistent mechanisms such as malicious cron jobs and reverse SSH tunnels. This incident highlights the dangerously narrow window organizations have between public patch disclosure and active exploitation in the wild. Virtualization infrastructure like vCenter is a high-value target because compromising it can cascade into full control over entire virtual environments. Organizations without rapid, prioritized patching processes for critical infrastructure are disproportionately exposed.