Critical VMware vCenter Vulnerability in Attackers’ Crosshairs

A critical directory traversal vulnerability in VMware vCenter (CVE-2026-59310) was actively weaponized by an APT actor shortly after Broadcom released a patch on July 29, demonstrating the dangerously narrow window organizations have to remediate critical flaws in widely-used virtualization infrastructure. The attacker leveraged the flaw to achieve remote code execution and deployed a reverse shell to establish persistent access — a technique that is difficult to detect and remove without robust monitoring. With over 360 IP addresses across 47 countries targeted, this represents a broad, coordinated campaign against organizations that delayed patching. This incident underscores that critical vulnerabilities in hypervisor and management-plane software represent exceptionally high-value targets, as compromise can cascade across entire virtualized environments.