A critical vulnerability in VMware vCenter came under heavy exploitation via a single threat actor just days after public disclosure.
CVE-2026–59310 is a critical directory traversal flaw with a 9.8 CVSS score that VMware disclosed on July 29. According to VMware owner Broadcom, an attacker with network access to a vCenter instance can remotely exploit the vulnerability to execute arbitrary code in the target's virtual environment.
In a blog post this week, German incident-response (IR) firm QUIRSO said it observed exploitation activity on a global scale that stemmed from a single threat actor. During a recent IR engagement, QUIRSO's Threat Research team uncovered evidence that a suspected advanced persistent threat actor began exploiting the flaw on Aug. 3, less than a week after public disclosure.
CVE-2026–59310 is the latest VMware vulnerability to come under exploitation, though so far attacks appear to be limited to just the one suspected APT actor. But, the attacks once again demonstrate the short window between public disclosure and active exploitation for heavily targeted vendors like VMware.