VMware vCenter Vulnerability Allows Persistent Remote Control

Threat actors have begun actively exploiting a recently patched critical security flaw in Broadcom’s VMware vCenter server, as reported by QUIRSO. The vulnerability, identified as CVE‑2026‑59310, carries a CVSS score of 9.8 and is a directory‑traversal bug that allows malicious actors with network access to execute arbitrary code once authenticated ¹.

The flaw arises from insufficient validation when handling file paths within web interfaces that remain accessible after authentication. Even users without administrative privileges can trigger it through crafted requests designed specifically against known API endpoints used internally inside Broadcom products ¹. By uploading specially constructed files containing nested directories, attackers bypass normal operation boundaries and obtain unauthorized access beyond what legitimate user activities would permit.

Once triggered, the exploit enables persistent remote access. Attackers move laterally into sensitive areas such as virtual machines employed for development environments—effectively giving them keys to nearly every server an organization owns. This lateral movement mirrors patterns seen during SolarWinds attacks, though VMware’s role isn’t central to those incidents. Given that over half of enterprise workloads run inside VMs, successful exploitation could impact thousands more companies than initially reported.

Broadcom released patches for this flaw shortly before its discovery by QUIRSO. However, many organizations still have not applied these updates, leaving their vCenter installations exposed. Security specialists recommend immediate application of the latest patch, coupled with monitoring internal APIs for anomalous activity. Organizations should also segment VM networks where possible to limit potential lateral spread.

While the vulnerability itself is a technical issue, its implications touch on online privacy: compromised systems may expose private data stored in virtualized environments, including customer information or proprietary code. The persistence granted by the exploit means attackers can maintain long‑term footholds without detection if proper logging and alerting are absent.

CVE‑2026‑59310 represents a high‑risk exposure for any business using VMware vCenter. Prompt remediation and vigilant network segmentation protect both system integrity and the privacy of data residing within virtual infrastructures.