Critical VMware vCenter RCE flaw exploited for reverse SSH access

A critical remote code execution flaw in VMware vCenter, identified as CVE-2026-59310, is being actively exploited to establish reverse SSH access, allowing attackers to maintain persistence and gain remote control. This vulnerability, which was recently patched, affects the vCenter Syslog Server and can be leveraged to deploy malicious tools. The exploitation of this flaw enables threat actors to bypass traditional security measures and gain unauthorized access to sensitive systems. The CVE-2026-59310 vulnerability has a significant impact on the attack surface, making it essential for organizations to prioritize patching based on their exposure and evidence of exploitation¹. This targeted campaign highlights the importance of prompt vulnerability management and monitoring for signs of exploitation. The exploitation of this flaw matters to security practitioners because it can lead to significant security breaches if left unaddressed, emphasizing the need for swift remediation.