Critical VMware vCenter RCE flaw exploited for reverse SSH access

A critical directory traversal vulnerability in VMware vCenter's Syslog Server component is being actively exploited by an APT actor, allowing attackers to achieve remote code execution and establish persistent reverse SSH tunnels for ongoing access. The breadth of compromise — 361 IP addresses across 47 countries — indicates that many organizations failed to apply the emergency patch in a timely manner or lacked visibility into internet-exposed vCenter instances. This is especially dangerous because vCenter manages virtual infrastructure at scale, meaning a single compromise can cascade into full datacenter control. The exploitation of a syslog-adjacent component highlights how ancillary services on critical platforms are often overlooked in patch prioritization. Swift patching of hypervisor and management-plane components must be treated as the highest possible priority given their blast radius.