[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f6JUZAsuDPnONxp0VAF5oY7MAqQYqZNSOvmUP7MOrZ9I":3},{"article":4,"iocs":51,"watch_terms":60,"solutions":61,"lesson":150},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"785c4f04-6e50-4557-b823-c08c887ebe23","Critical VMware vCenter RCE flaw exploited for reverse SSH access","critical-vmware-vcenter-rce-flaw-exploited-for-reverse-ssh-access-a4f4d6","A recently patched critical vulnerability (CVE-2026-59310) in VMware vCenter Syslog Server is being exploited in an active campaign to deploy a reverse SSH tool for persistence and remote access. [...]","A critical directory traversal vulnerability (CVE-2026-59310) in VMware vCenter Syslog Server is being actively exploited by an APT actor to deploy a reverse SSH tool for persistence and remote access. Compromises have been identified across 361 IP addresses in 47 countries, with significant concentrations in Germany, the U.S., Turkey, Iran, and France. VMware has released an emergency update to address the flaw.","Critical VMware vCenter flaw exploited for reverse SSH access.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fcritical-vmware-vcenter-rce-flaw-exploited-for-reverse-ssh-access\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2023\u002F10\u002F25\u002FVMware_red.jpg","2026-08-13T16:40:23+00:00","2026-08-13T18:00:38.34485+00:00",9,[17,20,23,25],{"name":18,"type":19},"VMware vCenter Syslog Server","product",{"name":21,"type":22},"VMware","vendor",{"name":24,"type":22},"Broadcom",{"name":26,"type":27},"SSH","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":28,"icon":30,"name":31,"slug":32},null,"Vulnerabilities","vulnerabilities",[34,39,44,46],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":40},{"id":41,"icon":30,"name":42,"slug":43},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":45},{"id":28,"icon":30,"name":31,"slug":32},{"category":47},{"id":48,"icon":30,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[52,56],{"type":53,"value":54,"context":55},"cve","CVE-2026-59310","Critical directory traversal vulnerability in VMware vCenter Syslog Server.",{"type":57,"value":58,"context":59},"malware","reverse_ssh","Open-source reverse SSH framework used for persistence and remote access.",[21,24,18],{"controls":62,"vendors":149},[63,92,120],{"slug":64,"name":65,"problem":66,"products":67},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[68,76,84],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":93,"name":94,"problem":95,"products":96},"patch-management","Automated patch management","Known holes get closed in days, not months.",[97,105,113],{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":93,"product_name":117,"url":118,"description":119},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":121,"name":122,"problem":123,"products":124},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[125,133,141],{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",[],{"slug":151,"title":152,"body":153,"framework_refs":154,"framework_notes":166},"critical-vmware-vcenter-rce-exploited-for-persistent-reverse-ssh-access","Critical VMware vCenter RCE Exploited for Persistent Reverse SSH Access","A critical directory traversal vulnerability in VMware vCenter's Syslog Server component is being actively exploited by an APT actor, allowing attackers to achieve remote code execution and establish persistent reverse SSH tunnels for ongoing access. The breadth of compromise — 361 IP addresses across 47 countries — indicates that many organizations failed to apply the emergency patch in a timely manner or lacked visibility into internet-exposed vCenter instances. This is especially dangerous because vCenter manages virtual infrastructure at scale, meaning a single compromise can cascade into full datacenter control. The exploitation of a syslog-adjacent component highlights how ancillary services on critical platforms are often overlooked in patch prioritization. Swift patching of hypervisor and management-plane components must be treated as the highest possible priority given their blast radius.",[155,156,157,158,159,160,161,162,163,164,165],"CIS Control 7 – Continuous Vulnerability Management","CIS Control 12 – Network Infrastructure Management","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-53 SI-2 – Flaw Remediation","NIST SP 800-53 SC-7 – Boundary Protection","NIST SP 800-53 RA-5 – Vulnerability Monitoring and Scanning","NIST CSF ID.AM-1 – Asset Inventory","NIST CSF RS.MI-3 – Newly Identified Vulnerabilities Mitigated","ITIL – Change and Release Management (Emergency Change)","MITRE ATT&CK T1572 – Protocol Tunneling (Reverse SSH)","MITRE ATT&CK T1190 – Exploit Public-Facing Application",{}]