[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fLC_MG4GV0-KLYrRMoBNw_LY2pHJxc6N54I1BNXDa0Pk":3},{"article":4,"iocs":57,"watch_terms":69,"solutions":70,"lesson":159},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":34,"category":35,"article_tags":39},"e2c81187-77d4-4219-b2ef-9c57d5dda2f1","Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access","attackers-exploit-vmware-vcenter-vulnerability-to-gain-persistent-remote-access-76131b","Threat actors have begun to actively exploit a recently patched critical security flaw in Broadcom VMware vCenter, according to new findings from QUIRSO. The vulnerability in question is CVE-2026-59310 (CVSS score: 9.8), a directory-traversal vulnerability in the VMware vCenter server that a malicious actor with network access can exploit to execute arbitrary code. Patches for the flaw were","Threat actors are actively exploiting a critical directory-traversal vulnerability (CVE-2026-59310) in Broadcom VMware vCenter to gain persistent remote access. The flaw allows for arbitrary code execution, and attackers are deploying malicious cron jobs using reverse_ssh to maintain access. QUIRSO discovered the exploitation following an incident response engagement, noting that the activity began shortly after Broadcom released patches.","Attackers exploit VMware vCenter CVE-2026-59310 for remote access and persistence.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Fattackers-exploit-vmware-vcenter.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhuo4K_GT6YrQhFiPQrrf58NN4PQM0_aYVTxWXeaJ1KsqjBJ69c746Hj6DyhGH-uzhZvEowVR8YMbITHBpOcT3OQevcTJg36qwJ1WfPtFZySMVg_B2JVBE763_JVHh3gn563WAYxf72bnd1g9QC2tkWd6Bbm9_TWXPhMxk1vnk6gxnUM4eDQNxXouVEtJ9i\u002Fs1600\u002Fvmware.jpg","2026-08-12T09:01:54+00:00","2026-08-12T10:00:09.704316+00:00",9,[17,20,23,26,29,31],{"name":18,"type":19},"VMware vCenter","product",{"name":21,"type":22},"Broadcom","vendor",{"name":24,"type":25},"UNC5174","threat_actor",{"name":27,"type":28},"PurpleHaze","campaign",{"name":30,"type":19},"GoReShell",{"name":32,"type":33},"APT","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":34,"icon":36,"name":37,"slug":38},null,"Vulnerabilities","vulnerabilities",[40,45,50,52],{"category":41},{"id":42,"icon":36,"name":43,"slug":44},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":46},{"id":47,"icon":36,"name":48,"slug":49},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":51},{"id":34,"icon":36,"name":37,"slug":38},{"category":53},{"id":54,"icon":36,"name":55,"slug":56},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[58,62,65],{"type":59,"value":60,"context":61},"cve","CVE-2026-59310","Directory-traversal vulnerability in VMware vCenter",{"type":59,"value":63,"context":64},"CVE-2026-59309","Unauthenticated auth-bypass in vmdir (mentioned as being scanned for)",{"type":66,"value":67,"context":68},"malware","reverse_ssh","Open-source tool used by attackers to establish persistence via SSH connections",[21,18,30],{"controls":71,"vendors":158},[72,100,129],{"slug":73,"name":74,"problem":75,"products":76},"patch-management","Automated patch management","Known holes get closed in days, not months.",[77,85,92],{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":73,"product_name":89,"url":90,"description":91},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":101,"name":102,"problem":103,"products":104},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[105,113,121],{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"slug":130,"name":131,"problem":132,"products":133},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[134,142,150],{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":143,"vendor_name":144,"vendor_logo":145,"product_slug":146,"product_name":147,"url":148,"description":149},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":151,"vendor_name":152,"vendor_logo":153,"product_slug":154,"product_name":155,"url":156,"description":157},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",[],{"slug":160,"title":161,"body":162,"framework_refs":163,"framework_notes":176},"vmware-vcenter-exploited-for-persistent-access-within-days-of-patch-release","VMware vCenter Exploited for Persistent Access Within Days of Patch Release","Threat actors rapidly weaponized CVE-2026-59310, a critical directory-traversal vulnerability in VMware vCenter, exploiting it almost immediately after Broadcom released the patch — a pattern known as 'patch-gap exploitation.' The flaw enables arbitrary code execution, giving attackers a foothold to deploy persistent mechanisms such as malicious cron jobs and reverse SSH tunnels. This incident highlights the dangerously narrow window organizations have between public patch disclosure and active exploitation in the wild. Virtualization infrastructure like vCenter is a high-value target because compromising it can cascade into full control over entire virtual environments. Organizations without rapid, prioritized patching processes for critical infrastructure are disproportionately exposed.",[164,165,166,167,168,169,170,171,172,173,174,175],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 10: Malware Defenses","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST SC-7: Boundary Protection","NIST IR-5: Incident Monitoring","NIST CM-6: Configuration Settings","ITIL: Change and Release Management (Emergency Change)","MITRE ATT&CK T1053.003: Scheduled Task\u002FJob – Cron","MITRE ATT&CK T1190: Exploit Public-Facing Application","MITRE ATT&CK T1572: Protocol Tunneling",{}]