VMware vCenter Syslog Flaw Exploited for Root RCE, Ransomware on ESXi
A critical path traversal vulnerability in VMware vCenter Server's Syslog feature is being actively exploited to gain root access, establish persistent SSH, and deploy ransomware on ESXi hosts.
A rapidly escalating campaign is weaponizing a critical path traversal vulnerability, identified as CVE-2026-59310, within VMware vCenter Server's Syslog functionality. Attackers are leveraging this flaw to execute commands with root privileges, bypass normal authentication mechanisms, and achieve comprehensive control over virtualized environments. The exploitation began mere days after the vulnerability's disclosure, highlighting the urgency for organizations to patch their systems.
Security researchers at QUIRSO GmbH have mapped the widespread impact, identifying 361 affected IP addresses across 47 countries. The compromised sectors include technology, research, education, and telecommunications, underscoring the broad appeal of vCenter management systems to threat actors. QUIRSO's investigation revealed an attack chain that progresses from initial code execution to persistent access, the creation of backdoor services, and ultimately, the deployment of ransomware on ESXi hosts.
The initial intrusion vector appears to involve the placement of malformed cron files in locations like /etc/cron.d, with filenames referencing the CVE and the Syslog service. The absence of authentication events alongside the execution of commands as root strongly suggests the Syslog path traversal vulnerability was used to write malicious content into a location that the cron scheduler would then execute. This technique effectively transforms the management appliance into a launchpad for further compromise.
Following the initial compromise, attackers established multiple layers of persistent access. This included deploying backdoor services that restarted automatically, creating fake tasks with VMware-like names to enable SSH access, and adding attacker-controlled SSH keys to the root user's authorized keys. The attackers also installed a web shell, created vSphere administrator accounts, and exfiltrated credentials from the local directory service.
Further complicating defenses, the campaign utilized an SSH-based reverse-tunnelling utility. This tool forces the compromised host to initiate an outbound connection to the attacker's command-and-control server, which can bypass network security controls designed to block unsolicited inbound traffic. The presence of such tools, alongside recurring cron activity or unexpected vCenter egress traffic, warrants thorough investigation.
The impact escalates significantly when attackers target ESXi hosts directly. After discovering the virtual infrastructure, threat actors created local administrator accounts on ESXi hosts and uploaded a ransomware executable along with helper scripts via the vSphere datastore browser. These scripts were used to stop virtual machines, encrypt VMFS volumes, and remove VMware's high-availability agent, potentially causing widespread service disruption.
The ransomware payload observed is derived from the Babuk ransomware family. It encrypts large portions of VMDK files, targeting the first 512 MB, and appends a new extension to the encrypted files. While the use of this specific ransomware family is not a definitive attribution, it adds to the growing threat of ransomware attacks targeting virtualized environments.
VMware has released security advisories and patches for CVE-2026-59310. Organizations are strongly urged to apply these updates immediately, as no workaround can fully mitigate the risk. Additionally, best practices include restricting direct public access to vCenter management interfaces, limiting administrative access to approved networks, and regularly reviewing new accounts and sudoer configurations for suspicious changes. Threat hunting for unauthorized remote access tools, backdoor services, and unexpected network connections is also critical.