One syslog write, root on 361 vCenter appliances

Between August 3 and August 5, 2026, a small team at Quirso watched roughly 343 vCenter Server Appliances in different countries start speaking to the same reverse SSH relay. By the time the campaign was catalogued the count had grown to 361 victims across 47 countries, with Germany, the United States, Turkey, Iran, and France carrying most of the load, according to Infosecurity Magazine's writeup of the Quirso report. Broadcom had shipped the fix on July 29 as part of VMSA-2026-0006. The bug is CVE-2026-59310, a directory traversal in the vCenter Syslog Server that a network reachable attacker turns into root code execution without ever authenticating. CISA added it to the Known Exploited Vulnerabilities catalog on August 18.

This one earns the CVSS 9.8. The interesting part is not the score. It is that the appliances that were caught were often the ones with vCenter reachable from a segment nobody had modeled as internet adjacent, and the appliances that were spared were often the ones patched five days late by accident.

Inside the syslog write that becomes root

The affected component is the Syslog Server that ships inside the vCenter Server Appliance. It accepts a payload with a path element that is supposed to stay inside a fixed working directory, and does not validate that path. An unauthenticated attacker sends a crafted HTTP request to the syslog endpoint containing sequences like ../../ or their URL encoded equivalents, and the write lands wherever the vCenter service account can put a file, which on a VCSA is a lot of places, per Cybersecurity News.

The write to execute step is the elegant part. The attacker drops a small ELF payload, seen in Quirso telemetry named linuxFile, into a location the appliance's own cron scheduler picks up. Minutes later the cron entry fires and the payload runs as root, as Bleeping Computer summarized. The payload itself is not novel. It is the Go implementation of reverse_ssh, an open source SSH server that dials out to attacker infrastructure, clearing egress rules that block inbound 22 but let 443 or 80 out. The Hacker News documents the same chain.

Two properties of that chain matter for defenders. The write runs under the vCenter service context, which on VCSA has file system access wide enough to plant persistence in a dozen directories, so hunting only the syslog spool misses it. The outbound tunnel looks like a plain SSH session to an unfamiliar host, and most vCenter appliances have never opened one before, so a single day baseline is enough to spot it.

The ESXi smokescreen almost worked

On a subset of the compromised hosts, the same actor moved down to the managed ESXi cluster and renamed log files with a .babyk extension, the file marker of a Babuk derived ransomware family. The encryption hit the ESXi log store rather than the guest VMDKs, and the more careful reading, shared by The Hacker News and independent trackers, is that the ransomware overlay is a smokescreen to burn timeline evidence before an incident responder shows up. Quirso attributes the activity, with moderate confidence, to a Chinese speaking actor operating in the UTC+08:00 window.

Why a 9.8 in the queue still gets deprioritized

A CVSS first triage queue has one job on July 29: bubble up every 9.8 in the VMSA-2026-0006 bundle. Most teams do that, and most also carry a few 9.8s from earlier weeks that have not shifted for a month. CVE-2026-59310 sat in that pile for five days. During that window, exploitation went from zero to 343 confirmed victims. A queue sorted only by severity treats those five days as identical, because the score does not move when the exploit code lands.

Two other properties push this one under the fold in a lot of scanners. The syslog service is not a common surface people watch, so agent based scanners without a plugin for the vCenter Syslog port do not raise a distinct signal. And because the exploit does not need a login, network based scanners that check for exposed vCenter often flag the login page rather than the syslog listener, so the finding attaches to the wrong port and the wrong severity story.

The TRIS layers behind the top band ACT verdict

TRIS, the Threat and Risk Intelligence Scoring engine inside CVEasy AI, does not read severity as a single number. For CVE-2026-59310 it walks four layers.

Exploitation. Confirmed active exploitation in the wild by an identified actor across 361 IPs and 47 countries, with a five day gap between patch release and campaign onset. Top band. A published PoC alone would not earn the same weight; confirmed in the wild abuse does.

Exposure. The finding attaches to the vCenter Syslog Server listener, not the login page. TRIS asks a different question than a normal scanner. Is the syslog port reachable from a segment that carries untrusted traffic? An internet exposed VCSA scores at the ceiling. A VCSA behind a management VLAN, only reachable from a jump host, scores several bands lower on the same CVE.

Blast radius. vCenter root is the crown of a virtualized estate. Once the attacker holds it, ESXi credentials, VM console access, snapshot manipulation, log tampering, and lateral movement into the guests all sit one hop away. The Quirso findings on .babyk renames confirm the operator reached ESXi from vCenter without a separate escalation step.

Threat actor fit. A moderate confidence China nexus attribution and a Babuk derived overlay both point at persistence and anti forensics rather than fast smash and grab. Environments with high value hypervisor targets in financial services, defense, and healthcare score higher on this axis than a consulting firm's dev cluster.

Same CVE, same 9.8, very different verdicts once TRIS layers the actual exposure. A confirmed exploit with an exposed appliance and a matching actor profile lands in top band ACT. A patched, contained VCSA with a jump host in front of it lands one tier down with a next window remediation timer.

Patch, hunt, rotate, close the smokescreen

Patch to a fixed vCenter build. Broadcom's advisory VMSA-2026-0006 lists the fixed versions: VMware vCenter Server 8.0 U3k, VMware Cloud Foundation 9.1.0.0300 and 9.0.2.0100, along with the 8.0 U2f branch where deployed. There is no workaround. Blocking the syslog listener at the perimeter helps only for internet exposed instances; it does nothing for an attacker inside the management network.

Hunt for the artifacts on every VCSA. Look for unexpected files in directories writable by the vCenter service account, especially anything in cron adjacent paths that arrived after July 29. Compare every cron entry against a fresh install baseline. A binary named linuxFile, or any Go compiled ELF you cannot account for, is a strong indicator; Quirso attributed those to this campaign.

Watch the egress. vCenter appliances almost never open outbound SSH sessions to arbitrary hosts. A single day of outbound port 22, 80, or 443 flow from any VCSA to an unfamiliar destination is worth a full triage; reverse SSH tunnels reuse standard ports on purpose, so the destination matters more than the protocol.

Rotate anything the appliance held. Root on vCenter reads vpxd credentials, SSO trust store material, ESXi credentials, and any vSphere API tokens kept on the appliance. Rotate them and force ESXi hosts to re-establish trust with vCenter after the patch. If your logs got hit with .babyk renames, preserve what you can from ESXi hostd on other paths and treat the log gap as evidence tampering.

Verify with a re-scan. Confirm the fixed build refuses the traversal payload and that no attacker cron entries survived the patch. A patched appliance still carrying persistence is a fixed CVE with an open backdoor.

Where CVEasy AI puts this on the queue

CVEasy AI, the number one local-first CTEM (Continuous Threat Exposure Management) platform, ingests the Broadcom VMSA, the CISA KEV addition, and the Quirso campaign telemetry the same day they land, then runs those signals against your own hypervisor inventory on your own hardware. If your VCSA build is affected and the syslog listener is reachable from a segment TRIS scored as untrusted, the finding shows up in the top band ACT queue with the remediation workflow above and a hunt checklist for the cron and reverse SSH artifacts already attached. If the appliance is patched but removal is unconfirmed, TRIS keeps the ticket open on the persistence hypothesis instead of closing it when the version number turns green. The inventory, the segmentation model, and the search for planted cron entries never leave the machine.

Sources: Broadcom VMSA-2026-0006, Infosecurity Magazine, The Hacker News (reverse SSH campaign), Bleeping Computer, Cybersecurity News, The Hacker News (China nexus and Babuk overlay), CISA KEV catalog.