TL;DR: If your shop runs its ERP, file server, and backups as VMware virtual machines, this is not one sick server, it is a hole in the box that runs the whole rack. A flaw disclosed July 29 now lets an anonymous attacker take over VMware vCenter, the console that controls every one of those machines. Attackers began exploiting it (CVE-2026-59310, CVSS 9.8) on August 3, 2026, and by August 5 roughly 95% of the 361 victim IP addresses eventually seen across 47 countries had already been hit. [1][3] It needs no login and has no workaround: you patch vCenter or you stay exposed. [2][5]
What is CVE-2026-59310, and why does one vCenter bug put every server you run at risk?
CVE-2026-59310 is a directory-traversal flaw in the vCenter Syslog server that lets an attacker with network access, and no password, take over the vCenter host, and it carries a CVSS score of 9.8. [1][2] Broadcom shipped it in advisory VMSA-2026-0006 on July 29, 2026, alongside a second 9.8 vCenter flaw, CVE-2026-59309, an authentication bypass. [5][6] There is no mitigation short of the patch. [5]
The reason this one outranks the average critical CVE is what vCenter is: the control plane for your whole VMware estate, the console that manages every ESXi host and, through them, every virtual machine you run. Own vCenter and the next steps are your domain controller, your ERP, your file server, and your SQL box, all sitting as VMs on the same cluster. For a fab shop, that ERP drives nesting, scheduling, and invoicing, so if its VM goes dark you cannot cut, ship, or bill, and 70 people stand idle on the clock. A Greensboro plant that virtualized ten years ago to cut hardware costs made the right call, and also crammed the whole server room onto one console, which is now exactly what the attacker aims at.
The attackers clearly did the math. Researchers first saw compromised hosts phoning home to attacker infrastructure on August 3. [2] On August 4 another 151 victim IP addresses lit up. [2] By August 5, around 95% of the 361 total victim IP addresses seen in the campaign had already been hit, spread across 47 countries. [1][3] This is indiscriminate, automated scanning of the whole internet, and a High Point IP is as reachable as any of them.
Bottom line: Lose vCenter and you lose every VM under it in one move. Patch it like the whole rack depends on it, because it does.
Run VMware vSphere or vCenter anywhere in the Piedmont Triad? Ask Preferred Data Corporation to confirm your version and exposure today before this becomes an after-hours rebuild. Not sure whether your shop even runs VMware? That is fine, and it is the point: a five-minute call tells you free whether this touches you. We are in High Point, on-site within 200 miles, and we have run infrastructure for North Carolina manufacturers since 1987. Call (336) 886-3282.
"Our vCenter is not on the internet." Does this still hit us?
Probably. "It is only on our internal network" is exactly the assumption getting shops owned right now. The flaw needs network access to vCenter, not internet access, and the attackers deploy an open-source tool called reverse_ssh that opens an outbound connection from the compromised host back to them. [2] That outbound channel walks straight past the inbound firewall rules most shops rely on, because your firewall is watching for connections coming in, not the hypervisor manager quietly dialing out. [2]
Here is how that plays out on the flat networks still common across Triad manufacturers. An employee in the Winston-Salem office opens a phished attachment, or a machine-tool vendor's laptop connects over a VPN with more reach than intended. The moment any device that can route to vCenter is compromised, the box is reachable, the exploit runs without credentials, and reverse_ssh gives a foothold on the one server that almost never has endpoint detection installed. Most shops run EDR on laptops and Windows servers and leave the appliance-style vCenter and ESXi hosts bare, which is the blind spot.
One more thing, and it should bother you. The researchers who tracked the campaign are withholding specific indicators of compromise because of law enforcement coordination, and they suspect an advanced persistent threat actor. [2][3] Translated for an owner: this is not a smash-and-grab, and "we did not see anything weird" is not evidence you were missed.
Key takeaway: The dangerous exposure is rarely a vCenter facing the open internet. It is a vCenter that any phished laptop or over-permissioned vendor connection on your network can reach, because the exploit needs no password and the attacker's channel dials outbound.
How bad is a vCenter compromise compared with losing a single server?
Losing one file server is a bad day; losing vCenter is the plant's IT gone in a single move, because the attacker inherits control of every VM on every host it manages. Print the table below and put it in front of whoever runs your VMware. It is in dollars and downtime, not CVSS scores.
| A single VM is compromised | vCenter is compromised (CVE-2026-59310) | |
|---|---|---|
| Blast radius | One server, one workload | Every ESXi host and every VM they run [1] |
| Credentials needed | Usually some access or a valid login | None, unauthenticated over the network [2] |
| What an attacker reaches | That machine's data | Domain controller, ERP, file server, SQL, all as VMs |
| Ransomware outcome | Restore one server from backup | Encrypt the datastore and every VM at once, backups included if they live on the same cluster |
| Detection odds | EDR likely installed | vCenter and ESXi usually run no EDR at all |
| Workaround while you wait | Sometimes | None, patch is the only fix [5] |
Look at the ransomware row. A crew that reaches the datastore can encrypt dozens of virtual machines in one stroke rather than fighting through them one at a time, and if your backup server is itself a VM on the same cluster, the same pass that encrypts production encrypts your recovery copy. We see that exact wiring more often than we should. "We have backups" is only an answer if those backups sit somewhere the hypervisor cannot reach.
Not sure whether your backups survive a hypervisor compromise? That is a same-week check for Preferred Data managed IT and monitoring, not a maybe. Call (336) 886-3282 and we will tell you where your recovery actually sits.
Which vCenter versions are affected, and what do you patch to?
Broadcom fixed CVE-2026-59310 in specific builds, and a version number alone is not proof you are safe until you confirm the exact running build. [5] The fixed releases named in VMSA-2026-0006 are VMware Cloud Foundation and vSphere Foundation 9.1.0.0300, VMware Cloud Foundation and vSphere Foundation 9.0.2.0100, and vCenter Server 8.0 U3k, with 8.0 U2f named for one branch. [5][2] If your vCenter is running anything earlier than the fixed build for its train, treat it as exposed.
Ask whoever manages your environment two plain questions. First, what exact vCenter build is running right now, not which major version, the full build number. Second, has the VMSA-2026-0006 update been applied and the appliance restarted since July 29. If the answer to the first is an older build and the second is "not yet" or "not sure," you are in scope and this is this week's work, not next quarter's. A patch you scheduled but did not apply does not count. The 361 victim IP addresses in this campaign had five days and a maintenance window, same as you. [3]
One more point on scope. VMSA-2026-0006 bundled more than this flaw, including the CVE-2026-59309 authentication bypass at the same 9.8 severity. [5][6] The advisory closes several holes at once, so apply it as a single planned update rather than cherry-picking.
The test: The running build number is what settles this, not the major version. If VMSA-2026-0006 has not been applied and the appliance restarted since July 29, 2026, assume you are exposed.
What should a North Carolina shop do this week?
Patch vCenter to a fixed build now, then verify nothing already got in, because exploitation is live and there is no workaround to buy you time. [2][5] Here is the order we work in for a client running an exposed or unsegmented vCenter:
- Inventory in an hour, not a project. Pull the exact vCenter build and confirm whether VMSA-2026-0006 is applied. Do the same for your ESXi hosts, since the advisory spans VMware products. [5]
- Schedule the vCenter update this week. The appliance update and restart is a defined maintenance window, and vCenter being briefly offline does not stop running VMs, so the disruption is smaller than owners fear. Size the window from Broadcom's guidance for your build.
- Assume-breach check the box. Because researchers are holding indicators back and the actor looks advanced, do not treat a clean-looking console as all-clear. [2][3] Review vCenter for unexpected outbound connections and unfamiliar processes, the reverse_ssh pattern being the specific thing to hunt.
- Get vCenter off the flat network. Put the management plane behind segmentation so a random laptop in accounting cannot route to it. This is the single change that most reduces your exposure to the next vCenter flaw, and there will be one.
- Confirm your backups are out of reach. Verify at least one recent, tested backup lives somewhere the hypervisor cannot touch, so a datastore encryption event is a restore, not a closure.
For a shop with no in-house VMware specialist, steps one through three are a same-day engagement. Preferred Data handles VMware patching and validation as part of managed IT and monitoring across Charlotte, Greensboro, Raleigh, and the wider Piedmont Triad, so the box that runs your whole server room is not waiting on someone happening to read an advisory.
Should vCenter ever be reachable in 2026, and where should backups sit?
No, and this is the strategy conversation the patch should start. Patching CVE-2026-59310 is mandatory and urgent, but it closes one hole in a management console that should never have been reachable from general user space to begin with. The blunt position we take with owners: if your plan is only "patch faster," you are chasing a fix that will always land after the attack does. The deeper problem is that the console running your whole rack is sitting on the same network as accounting's Outlook. We have walked into shops where a receptionist's PC could ping vCenter, and that is the thing to close.
The fix is to put the control plane for your virtual estate on its own segment, reachable only from a small set of known administrative machines, never from the same network as email and browsers. Pair that with backups that are immutable or genuinely offline, so the recovery copy is not sitting on the cluster the attacker just took. That is a project you schedule, not a weekend you lose. Do it once and the next VMware advisory is something you read over coffee instead of at 2 a.m.
For some Triad shops, this flaw reopens a fair question about staying on Broadcom-era VMware at all, given the licensing changes since the acquisition. We would never tell a shop to rip out a working platform to dodge a CVE. But if a virtualization refresh or a move toward cloud solutions is already on your roadmap, put security posture in that math next to cost.
Monday, do one thing: have whoever touches your VMware read you back the exact vCenter build number and tell you whether VMSA-2026-0006 is on it. If they cannot, or you have no one to ask, call Preferred Data Corporation at (336) 886-3282 and we will find out for you. We are at 1208 Eastchester Drive, Suite 131, High Point, NC 27265, and we have run this stuff for North Carolina manufacturers since 1987.
Frequently Asked Questions
Does CVE-2026-59310 mean our data was already stolen?
Not necessarily, but you cannot rule it out from a quick look. This is a remote code execution flaw, so a successful exploit gives an attacker control of the vCenter host, well beyond a crash. [1][2] Because the researchers tracking the campaign are withholding indicators of compromise and suspect an advanced actor, a console that looks normal is not proof you were missed. [2][3] Patch, then run an assume-breach check of vCenter and the hosts it manages.
We patch on Patch Tuesday. Is that fast enough for this?
No. Patch Tuesday is a Microsoft cadence, and this is a Broadcom advisory that was already being exploited five days after it published. [3] Exploitation of an unauthenticated, no-workaround flaw in your management plane runs on the attacker's clock, not a monthly window. Treat an actively-exploited vCenter flaw as out-of-band emergency work, scheduled as fast as your operation can take a short vCenter restart.
Our vCenter is only on the internal network. Are we still at risk?
Very likely yes. The exploit needs network access to vCenter, not internet access, and the attackers use an outbound reverse-SSH channel that bypasses inbound firewall rules. [2] On a flat network, any compromised laptop or over-permissioned vendor connection that can reach vCenter is enough. Segmenting the management plane is the durable fix.
If ransomware hits our hypervisor, do our backups still save us?
Only if those backups sit somewhere the hypervisor cannot reach. A crew that reaches the datastore encrypts every VM on the cluster at once, and a backup server running as a VM on that cluster goes with them. Verify at least one recent, tested backup is immutable or offline, outside the reach of vCenter and the ESXi hosts.
What exactly do we upgrade to in order to fix this?
The fixed builds named in Broadcom's VMSA-2026-0006 are VMware Cloud Foundation and vSphere Foundation 9.1.0.0300, VMware Cloud Foundation and vSphere Foundation 9.0.2.0100, and vCenter Server 8.0 U3k, with 8.0 U2f named for one branch. [5][2] Confirm the exact running build before and after, because a major version number alone does not tell you whether the fix is applied.
We are a 60-person manufacturer without a VMware expert. Where do we start?
Start with the running vCenter build and whether VMSA-2026-0006 is applied, then schedule the update this week. [5] If you have no one in-house to do it safely, a managed IT provider can inventory, patch, validate, and segment the management plane. Preferred Data does exactly this for North Carolina shops and treats an actively-exploited flaw as priority work.
Related Resources
- Cybersecurity Services
- Managed IT and Monitoring for NC Businesses
- Network Infrastructure and Segmentation
- Backup and Data Protection
- Manufacturing IT Solutions
- Contact Preferred Data to confirm your VMware exposure
References
- SecurityWeek. (2026, August). Critical VMware vCenter Vulnerability in Attackers' Crosshairs. https://www.securityweek.com/critical-vmware-vcenter-vulnerability-in-attackers-crosshairs/
- BleepingComputer. (2026, August). Critical VMware vCenter RCE flaw exploited for reverse SSH access. https://www.bleepingcomputer.com/news/security/critical-vmware-vcenter-rce-flaw-exploited-for-reverse-ssh-access/
- Infosecurity Magazine. (2026, August). vCenter Flaw Exploited Just Five Days After Disclosure. https://www.infosecurity-magazine.com/news/vcenter-cve-2026-59310-exploited/
- The Hacker News. (2026, August). Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access. https://thehackernews.com/2026/08/attackers-exploit-vmware-vcenter.html
- Broadcom. (2026, July 29). VMSA-2026-0006: VMware vCenter Server and VMware Cloud Foundation updates. https://github.com/vmware/vcf-security-and-compliance-guidelines/tree/main/security-advisories/vmsa-2026-0006
- Rapid7. (2026, August). ETR: Critical VMware vCenter Vulnerabilities Allow Authentication Bypass and Remote Code Execution (CVE-2026-59309, CVE-2026-59310). https://www.rapid7.com/blog/post/etr-critical-vmware-vcenter-vulnerabilities-allow-authentication-bypass-and-remote-code-execution-cve-2026-59309-cve-2026-59310/