CVE-2026-59310: Actively Exploited VMware vCenter Directory Traversal — Detection and Remediation Guide

Broadcom's VMware vCenter Server is once again in the crosshairs. Security researchers at QUIRSO have confirmed that threat actors are actively exploiting CVE-2026-59310, a critical directory-traversal vulnerability in vCenter Server carrying a CVSS score of 9.8. The flaw is remotely exploitable by an attacker with network access to the vCenter management interface — no authentication, no user interaction, no special conditions.

The attack objective in observed campaigns is not smash-and-grab. Actors are using exploitation to achieve persistent remote access — which, in the vCenter context, means planting webshells or backdoor accounts on the management plane that controls your entire virtualization estate. If an adversary owns vCenter, they own every ESXi host, every VM, every datastore, and every snapshot your organization depends on. For ransomware crews and espionage actors alike, vCenter compromise is the shortest path to maximum blast radius.

If your vCenter instance is reachable from anything other than a tightly segmented management network, treat this as an incident-in-progress, not a patching exercise. Verify integrity first, patch second, hunt third — in that order of urgency, often in parallel.

Technical Analysis

Affected Product and Attack Surface

The vulnerable component is VMware vCenter Server (the vCenter Server Appliance, VCSA), specifically a path-handling flaw in one of the appliance's HTTP services that sit behind the reverse proxy (rhttpproxy) fronting ports 443 and, where exposed, the management/VAMI endpoint on 5480. The vCenter appliance runs a Photon OS base with key Java services — vpxd (the core vCenter daemon), the vsphere-ui Tomcat instance, and envoy/rhttpproxy as the edge listener — all running with elevated privileges. Code execution achieved through these services typically lands as a high-privilege user on the appliance, effectively giving the attacker the keys to the kingdom.

The Vulnerability: Directory Traversal to Code Execution

CVE-2026-59310 is a directory-traversal vulnerability: the affected vCenter endpoint fails to properly sanitize path components in HTTP requests, allowing an attacker to escape the intended web root using sequences such as ../ or URL-encoded variants (%2e%2e%2f, %252e, overlong UTF-8 encodings). In practical terms, traversal flaws in vCenter-class appliances are typically chained in one of two ways:

1. Arbitrary file read — extracting credentials, vpxd.cfg, the vmdir/PSC database, session tokens, or data.mdb secrets that enable full vCenter authentication and lateral movement into ESXi hosts.
2. Arbitrary file write — dropping a JSP webshell into a Tomcat webapps directory (historically under /usr/lib/vmware-vsphere-ui/server/work/deployer/s/global/... or equivalent paths), writing an SSH authorized_keys entry, or planting a script invoked by a scheduled task — yielding direct remote code execution.

The QUIRSO reporting confirms actors are achieving arbitrary code execution and using it to establish persistence — consistent with webshell deployment and/or the creation of rogue local accounts and cron/systemd persistence on the appliance.

Exploitation Requirements and Status

• Prerequisites: Network reachability to the vulnerable vCenter HTTP(S) endpoint. No credentials required.
• Complexity: Low — traversal payloads are trivial to construct once the vulnerable path is known.
• Status: Confirmed active in-the-wild exploitation per QUIRSO, with post-exploitation behavior indicating hands-on-keyboard operators establishing durable access. Expect rapid scanning and opportunistic mass exploitation given the 9.8 score and the ubiquity of vCenter in enterprise environments. Organizations should also monitor CISA's Known Exploited Vulnerabilities catalog — a flaw of this profile is a near-certain KEV candidate with a short federal remediation deadline.

Patches were released by Broadcom before exploitation was publicly documented — which means defenders are now racing attackers who are reverse-engineering the patch and harvesting unpatched, internet-exposed appliances.

Detection & Response

vCenter appliances send syslog if configured — if yours doesn't forward logs to your SIEM today, that gap is now a critical finding on its own. The detections below target the three most reliable observable layers: HTTP request artifacts (traversal payloads at the edge), process execution anomalies (webshells spawning shells from Tomcat/Java), and persistence artifacts (new files, new accounts, modified services).

Sigma Rules

---
title: HTTP Directory Traversal Attempt Against vCenter Server
description: Detects directory traversal sequences in HTTP requests directed at VMware vCenter endpoints, consistent with exploitation of CVE-2026-59310. Alert on requests containing encoded or raw traversal sequences hitting the appliance's reverse proxy.
references:
  - https://thehackernews.com/2026/08/attackers-exploit-vmware-vcenter.html
author: Security Arsenal
date: 2026/08/14
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_target:
    cs-host|contains:
      - 'vcenter'
      - 'vcsa'
  selection_traversal:
    cs-uri|contains:
      - '../'
      - '..\\'
      - '%2e%2e'
      - '%252e'
      - '..%2f'
      - '%2f..'
      - '..%c0%af'
  condition: selection_target and selection_traversal
falsepositives:
  - Rare; legitimate vCenter API and UI traffic does not contain traversal sequences
level: high
---
title: Webshell Child Process Spawned by vCenter Java Services
description: Detects shell or utility processes spawned by vCenter Tomcat/Java services (vsphere-ui, vpxd), a strong indicator of webshell execution following exploitation of CVE-2026-59310. vCenter Java services do not legitimately spawn interactive shells or common post-exploitation binaries.
references:
  - https://thehackernews.com/2026/08/attackers-exploit-vmware-vcenter.html
author: Security Arsenal
date: 2026/08/14
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/java'
      - '/tomcat'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/python'
      - '/python3'
      - '/perl'
      - '/base64'
  condition: selection_parent and selection_child
falsepositives:
  - Infrequent vendor diagnostics scripts; validate against Broadcom-issued support bundles
level: critical
---
title: Persistence Artifact Creation on vCenter Appliance
description: Detects creation of JSP files in vSphere UI web directories, new local user account creation, or new SSH authorized_keys entries on the vCenter appliance — all consistent with persistence establishment following CVE-2026-59310 exploitation.
references:
  - https://thehackernews.com/2026/08/attackers-exploit-vmware-vcenter.html
author: Security Arsenal
date: 2026/08/14
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.t1136.001
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|contains:
      - '/usr/lib/vmware-vsphere-ui/'
      - '/root/.ssh/authorized_keys'
      - '/home/*/.ssh/authorized_keys'
  selection_jsp:
    TargetFilename|endswith: '.jsp'
  condition: selection or (selection_jsp)
falsepositives:
  - vCenter patching and upgrade operations; suppress during approved change windows
level: high

KQL — Microsoft Sentinel

Assumes vCenter syslog is forwarded to Sentinel (via a Linux syslog collector or CEF connector). The first query hunts the HTTP-layer exploitation attempts; the second hunts the post-exploitation process behavior.

// Hunt: Directory traversal probes against vCenter (CVE-2026-59310)
// Requires vCenter rhttpproxy/syslog forwarding via Syslog or CEF
let TraversalPatterns = dynamic(["../", "%2e%2e", "%252e", "..%2f", "%2f..", "..%c0%af"]);
Syslog
| where TimeGenerated > ago(14d)
| where SyslogMessage has_any (TraversalPatterns)
| where SyslogMessage has_any ("vcenter", "rhttpproxy", "envoy", "443")
    or Computer has_any ("vcenter", "vcsa")
| extend SourceIP = extract(@"(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})", 1, SyslogMessage)
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Attempts = count(), SampleRequests = make_set(SyslogMessage, 10)
    by SourceIP, Computer, ProcessName
| order by Attempts desc;

// Hunt: Shell execution under vCenter Java/Tomcat services (webshell indicator)
// Requires auditd or CEF-based process events from the appliance
Syslog
| where TimeGenerated > ago(14d)
| where Facility == "authpriv" or SyslogMessage has_any ("bash", "/bin/sh", "curl", "wget", "base64")
| where SyslogMessage has_any ("vsphere-ui", "vpxd", "tomcat", "java")
| project TimeGenerated, Computer, ProcessName, SyslogMessage, HostIP
| order by TimeGenerated desc;

// Correlation: outbound connections from vCenter to rare external destinations post-request
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where DeviceProduct has "vCenter" or SourceHostName has_any ("vcenter", "vcsa")
| where DeviceAction !contains "deny"
| summarize ConnCount = count(), DistinctDestinations = dcount(DestinationIP), Destinations = make_set(DestinationIP, 20)
    by SourceIP, DestinationPort
| where ConnCount < 5  // rare egress — beaconing candidate
| order by ConnCount asc;

Velociraptor VQL — Appliance-Adjacent Endpoint Hunt

For organizations running Velociraptor with collectors on jump hosts or management workstations that administer vCenter (a common lateral movement and credential-theft pivot), hunt for evidence of traversal tooling and webshell interaction. If you have an agent deployed on the appliance itself in a lab/approved configuration, the second artifact applies directly.

-- Hunt for vCenter exploitation tooling on management workstations
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(vcenter|vcsa).*(\.\./|%2e%2e|%252e)'
   OR CommandLine =~ '(?i)curl.*vcenter.*(\.\./|%2e%2e)'
   OR CommandLine =~ '(?i)(webshell|\.jsp).*(upload|cmd)'

-- Inventory suspicious JSP and recently modified web content on a vCenter appliance
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=['/usr/lib/vmware-vsphere-ui/**/*.jsp',
                 '/usr/lib/vmware-vsphere-welcome/**/*.jsp',
                 '/root/.ssh/authorized_keys',
                 '/etc/cron.d/*'])
WHERE Mtime > now() - (14 * 24 * 3600)
ORDER BY Mtime DESC

Remediation & Verification Script (Bash — run on the VCSA via SSH)

This script checks the appliance build against the patched release, hunts traversal artifacts in the reverse-proxy and UI logs, inventories recent JSP writes, enumerates local accounts and scheduled persistence, and flags unexpected outbound listeners. Run it as root on the appliance shell; snapshot the appliance first if you intend to preserve forensic state.

#!/bin/bash
# CVE-2026-59310 vCenter verification & triage script — run as root on VCSA

REPORT=/tmp/vcenter_cve-2026-59310_triage_$(date +%Y%m%d_%H%M).txt
exec > >(tee -a "$REPORT") 2>&1

echo "=== [1] Appliance version / build ==="
vpxd -v 2>/dev/null
cat /etc/vmware/.buildInfo 2>/dev/null
# ACTION: Compare build against Broadcom's advisory for CVE-2026-59310.
# If below the fixed build, the appliance is vulnerable — isolate and patch immediately.

echo "=== [2] Traversal patterns in reverse proxy / UI access logs ==="
for LOG in /var/log/vmware/rhttpproxy/rhttpproxy.log \
           /var/log/vmware/envoy/envoy-access.log \
           /var/log/vmware/vsphere-ui/logs/localhost_access_log*.txt; do
  [ -f "$LOG" ] && grep -Ei '(\.\./|%2e%2e|%252e|\.\.%2f|%2f\.\.|%c0%af)' "$LOG" | tail -100
done
# ACTION: Any hits from external/unexpected source IPs = investigate as attempted exploitation.

echo "=== [3] Recently written JSP / web content (last 14 days) ==="
find /usr/lib/vmware-vsphere-ui /usr/lib/vmware-vsphere-welcome \
  -name '*.jsp' -mtime -14 -exec ls -la --time-style=long-iso {} \; 2>/dev/null
# ACTION: Any JSP not attributable to a documented patch/upgrade is a suspected webshell.

echo "=== [4] Local accounts and shell-enabled users ==="
awk -F: '($3 >= 1000 || $3 == 0) && $7 !~ /nologin|false/ {print}' /etc/passwd
grep -Ei '(useradd|adduser|new user)' /var/log/messages* /var/log/audit/audit.log 2>/dev/null | tail -50

echo "=== [5] Persistence: cron, systemd units, SSH keys ==="
ls -la /etc/cron.d/ /var/spool/cron/ 2>/dev/null
find /etc/systemd/system -mtime -14 -name '*.service' 2>/dev/null
for d in /root /home/*; do [ -f "$d/.ssh/authorized_keys" ] && ls -la "$d/.ssh/authorized_keys"; done

echo "=== [6] Listeners and established outbound sessions ==="
ss -tlnp 2>/dev/null
ss -tnp state established 2>/dev/null | grep -v ':443 ' | head -50
# ACTION: Unknown listeners or persistent outbound sessions to non-VMware IPs = active compromise.

echo "=== Triage complete. Report saved to $REPORT — preserve before patching. ==="

Remediation

1. Patch immediately. Apply Broadcom's security update for CVE-2026-59310 via the standard VCSA patching path (VAMI → Update, or software-packages from the appliance shell against the staged ISO). Confirm the post-patch build matches the fixed build listed in Broadcom's security advisory at https://support.broadcom.com/web/ecx/security-advisory (search for the CVE; also monitor the Broadcom/VMware Security Advisories feed). Do not assume "patch available" equals "patch applied" — verify the build string with vpxd -v.

2. Assume breach before you patch. Because exploitation predates many patch deployments, patching alone does not evict an attacker. Before and after patching:

• Run the triage script above and archive its output off-appliance.
• Rotate all credentials that vCenter touches: vCenter SSO administrator (administrator@vsphere.local and any SSO admins), appliance root, service accounts used for ESXi host management, and any credentials stored for integrated backup/monitoring platforms.
• If a webshell, rogue account, or unknown listener is found, treat it as a full incident: isolate the appliance, preserve a snapshot for forensics, and consider rebuilding VCSA from scratch and restoring configuration — vCenter redeploy is fast; rootkit hunting on a Photon appliance is not.

3. Eliminate exposure. vCenter must never be internet-reachable. Confirm via external attack-surface scanning that ports 443/5480 on the appliance are not exposed. Restrict vCenter access to a dedicated management VLAN with firewall ACLs permitting only admin jump hosts, and enforce MFA-protected access on the management path.

4. Harden and instrument.

• Enable vCenter syslog forwarding to your SIEM now (/etc/rsyslog.d/ or via VAMI → Syslog configuration) — detection without logs is a prayer.
• Review ESXi host lockdown mode settings so that a vCenter compromise doesn't trivially cascade to direct host shells.
• Snapshot/backup vCenter configuration to offline storage; validate restore.
• Subscribe to CISA KEV alerts — if CVE-2026-59310 lands in KEV (highly likely given confirmed exploitation), federal agencies face a binding remediation deadline and everyone else gets a defensible "patch by" date to wave at change management.

5. Hunt retrospectively. Traversal exploitation attempts live in rhttpproxy/envoy access logs. Pull at least the last 30 days of logs before they rotate and run the Sigma/KQL logic above against historical data — exploitation may have occurred weeks before the public disclosure.

The through-line of every vCenter compromise I've responded to is the same: the appliance was treated as infrastructure, not as the crown-jewel identity-and-control plane it actually is. It wasn't logged, wasn't segmented, and wasn't patched with zero-day urgency. CVE-2026-59310 is your forcing function to fix all three.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub