Five days from vCenter disclosure to compromise, and the cron job outlives the patch

Attackers began exploiting CVE-2026-59310, a directory-traversal flaw in VMware vCenter, on August 3, five days after Broadcom publicly disclosed it, and German incident response firm QUIRSO has counted 361 unique victim IP addresses across 47 countries ^[5][6][7]. The reason this matters more than the usual critical-CVE cycle: persistence was established with a malicious cron job running reverse_ssh, which survives the patch you applied afterwards ^[4].

The vulnerability carries a CVSS score of 9.8 and allows an attacker with network access to the vCenter server to execute arbitrary code ^[2][3]. Broadcom released patches late last month ^[8]. Working backward from QUIRSO's timeline, disclosure landed on or about July 29 ^[20]. QUIRSO found the activity during an incident response engagement, and describes an attack chain of path traversal consistent with the flaw followed by cron-based persistence using reverse_ssh, an open-source tool for building SSH connections back to attacker-controlled infrastructure ^[1][4].

That direction of travel is the point. reverse_ssh gives the operator an outbound connection to an endpoint they control, which sidesteps controls built to stop suspicious inbound requests ^[13]. An appliance that has been patched, rebooted and marked green in the tracker still dials out on schedule if the cron entry is untouched ^[4][13].

Victims are concentrated in Germany, the United States, Turkey, Iran and France ^[7]. Who is running the campaign is not established; QUIRSO says it is believed to be a suspected advanced persistent threat actor ^[10]. The publication notes context rather than attribution: VMware appliances have been repeatedly targeted by Chinese threat actors such as UNC5174, which has weaponised VMware Tools and vCenter flaws in espionage campaigns, and in April 2025 SentinelOne documented a China-nexus cluster it called PurpleHaze using a Windows backdoor, GoReShell, that borrows reverse_ssh functionality for reverse SSH connections ^[11][12]. On timing, QUIRSO's own reading is careful: the attacker "might have had prior knowledge of the vulnerability", but the correlation between disclosure and exploitation "suggests the disclosure as the initial starting point for the campaign" ^[9].

For defenders doing the hunt, QUIRSO's caveat is worth quoting exactly: "The presence of reverse_ssh should not, by itself, be treated as proof of malicious activity." Combined with unauthorised installation, unexpected outbound connections, or execution on a vulnerable vCenter appliance, the firm calls it a high-priority indicator requiring investigation ^[14].

There is a second, separate problem in the same product. Defused Cyber says it is seeing a spike in scanning against vCenter suggestive of exploitation attempts against CVE-2026-59309, also CVSS 9.8, an unauthenticated authentication bypass in vmdir covered by Broadcom's VMSA-2026-0006 ^[15][16]. Its honeypots are logging version probes via POST /sdk/ (RetrieveServiceContent) and walks of the /websso SAML SSO flow ^[16]. Denis Szadkowski, COO and co-founder of QUIRSO GmbH, told The Hacker News there is not enough evidence to tie that scanning to the intrusion set or infrastructure behind CVE-2026-59310, while adding that what his team investigated "represents a successful compromise rather than merely exploitation attempts", with forensic evidence pointing to CVE-2026-59310 as the initial access vector ^[17][18].

What to watch: whether anyone links the 59309 scanning to the 59310 operator ^[17], whether the 361-IP count grows as more engagements close ^[6], and whether victim organisations treat patched appliances as clean. Any vCenter exposed between roughly July 29 and the day it was patched needs a cron and outbound-connection review, not a version check ^[20][4].