VMware vCenter Syslog RCE (CVE‑2026‑59310) weaponized for reverse‑SSH persistence
Broadcom’s VMSA‑2026‑0006 patched a directory‑traversal RCE in vCenter’s syslog server (CVE‑2026‑59310). Within five days of disclosure, threat actors began exploiting it to drop a reverse_ssh cron job, gaining persistent outbound access on at least 361 hosts across 47 countries. The attack underscores the need to patch immediately and monitor for unexpected outbound SSH traffic.