VMware vCenter Flaw Exploited in 47 Countries After Disclosure

An active exploitation campaign targeting a critical vulnerability in VMware vCenter software has compromised systems in 47 countries, with researchers observing 361 unique victim IP addresses. The attacks began within days of the flaw's public disclosure, according to findings from the German digital forensics firm QUIRSO.

The vulnerability, tracked as CVE-2026-59310, is a directory traversal flaw in the vCenter Syslog server with a maximum severity CVSS score of 9.8. Broadcom, which owns VMware, disclosed the issue on July 29, 2026, and released emergency patches. The company stated that an unauthenticated attacker with network access could exploit the flaw to execute arbitrary code. No workarounds were provided, making immediate patching the only supported mitigation.

QUIRSO reported that compromised systems first began connecting to attacker-controlled infrastructure on August 3, just five days after the disclosure. The campaign expanded rapidly, with 151 new victim IP addresses observed on August 4 and a total of 343 by August 5. By August 7, the count reached 361. More than half of the identified IP addresses were located in Germany, the United States, Turkey, Iran, and France.