[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f52jEBhm3pY4LUNLylb88yGYVoUOBqulkk8ImPYeZl6E":3},{"article":4,"iocs":55,"watch_terms":72,"solutions":73,"lesson":161},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"e1133ab5-f476-44bc-9404-9aeaa002b7ae","CISA: Critical VMware RCE flaw now exploited by ransomware gangs","cisa-critical-vmware-rce-flaw-now-exploited-by-ransomware-gangs-0d4ce8","The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned security teams that ransomware gangs have now joined ongoing attacks exploiting a critical VMware vCenter vulnerability patched in July. [...]","The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning that ransomware gangs are now actively exploiting a critical VMware vCenter vulnerability (CVE-2026-59310). This flaw, a directory traversal vulnerability in the vCenter Syslog server, allows unauthenticated attackers to execute arbitrary code. Initially patched in July, the vulnerability was added to CISA's Known Exploited Vulnerabilities catalog, and now its exploitation by ransomware operations is confirmed.","CISA warns ransomware gangs are exploiting a critical VMware vCenter RCE flaw.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fcisa-critical-vmware-vcenter-rce-flaw-now-exploited-by-ransomware-gangs\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2024\u002F11\u002F18\u002FVMware.jpg","2026-09-15T12:16:32+00:00","2026-09-15T14:00:48.156429+00:00",9,[17,20,22,24,27,29],{"name":18,"type":19},"VMware vCenter","product",{"name":21,"type":19},"VMware ESXi",{"name":23,"type":19},"VMware Aria Operations",{"name":25,"type":26},"VMware","vendor",{"name":28,"type":26},"Broadcom",{"name":30,"type":31},"ransomware gangs","threat_actor","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":32,"icon":34,"name":35,"slug":36},null,"Malware","malware",[38,43,48,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"7d8b5ab8-ea0b-4ced-ae97-ec251b86993a","Ransomware","ransomware",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":49},{"id":32,"icon":34,"name":35,"slug":36},{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,60,63,66,69],{"type":57,"value":58,"context":59},"cve","CVE-2026-59310","Critical VMware vCenter Syslog server directory traversal vulnerability.",{"type":57,"value":61,"context":62},"CVE-2025-60710","VMware vulnerability mentioned in relation to ransomware attacks.",{"type":57,"value":64,"context":65},"CVE-2025-22225","VMware ESXi sandbox escape vulnerability.",{"type":57,"value":67,"context":68},"CVE-2026-22719","VMware Aria Operations vulnerability.",{"type":57,"value":70,"context":71},"CVE-2024-37079","VMware vCenter Server vulnerability.",[25,28,18],{"controls":74,"vendors":160},[75,104,132],{"slug":76,"name":77,"problem":78,"products":79},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[80,88,96],{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":105,"name":106,"problem":107,"products":108},"patch-management","Automated patch management","Known holes get closed in days, not months.",[109,117,125],{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":105,"product_name":129,"url":130,"description":131},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":54,"name":133,"problem":134,"products":135},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[136,144,152],{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":145,"vendor_name":146,"vendor_logo":147,"product_slug":148,"product_name":149,"url":150,"description":151},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":153,"vendor_name":154,"vendor_logo":155,"product_slug":156,"product_name":157,"url":158,"description":159},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",[],{"slug":162,"title":163,"body":164,"framework_refs":165,"framework_notes":177},"ransomware-gangs-exploit-unpatched-vmware-vcenter-rce-flaw","Ransomware Gangs Exploit Unpatched VMware vCenter RCE Flaw","A critical directory traversal vulnerability in VMware vCenter (CVE-2026-59310) is being actively exploited by ransomware groups, allowing unauthenticated attackers to execute arbitrary code on affected systems. Despite a patch being available since July, many organizations failed to apply it in a timely manner, leaving their virtualization infrastructure — often the backbone of enterprise environments — exposed. This gap between patch availability and patch deployment is a recurring and dangerous pattern, as threat actors actively monitor public vulnerability disclosures to target slow-moving organizations. The consequences of a compromised vCenter environment are severe, since attackers can pivot to every virtual machine under its management, amplifying ransomware impact across the entire infrastructure.",[166,167,168,169,170,171,172,173,174,175,176],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 18: Penetration Testing","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST SI-5: Security Alerts, Advisories, and Directives","NIST SC-7: Boundary Protection (Network Segmentation)","NIST RA-5: Vulnerability Monitoring and Scanning","CISA BOD 22-01: Known Exploited Vulnerabilities Catalog","ITIL 4: Change Enablement (Emergency Change Process)","VMware VMSA-2026-59310 Security Advisory",{}]