A vCenter flaw was exploited five days after the patch shipped.

What CVE-2026-59310 is

It is a directory traversal flaw in VMware vCenter, the console from which an entire virtualised estate is administered. It carries a CVSS score of 9.8, and that score comes from the combination that does the most damage: it allows code execution without authentication.

Directory traversal means tricking an application into stepping outside the folder it should stay in and reading or writing where it should not. When the place it writes to is the server controlling every virtual machine in an organisation, the result is administrative control of the data centre.

The timeline is the story

The flaw itself is not the striking part. The dates are:

• 29 July 2026. Broadcom ships the patch.
• Five calendar days later. Real-world exploitation begins.
• 18 August. CISA adds it to the Known Exploited Vulnerabilities catalog and gives US federal agencies until 21 August to patch.

Five days is shorter than many organisations' monthly maintenance cycle. That is the thing to take away: the window between a patch shipping and someone using it has closed to the point where "we patch on the first Tuesday of the month" protects against nothing once the flaw is public.

There is an uncomfortable irony here: publishing the patch is also giving the warning. A patch is a description of the flaw written by the vendor, and anyone who can read it can work backwards to the attack. That is why the clock starts when the fix is published, not when the bug is found.

Who is behind it, and what they leave

The firm QUIRSO attributes the campaign, with moderate confidence, to a Chinese-speaking threat actor. That qualifier matters: in threat intelligence, "moderate confidence" means the indicators point that way without proving it. And attribution indicators are forgeable.

What is observable is the payload: a Babuk-derived ransomware that encrypts and leaves files with a .babyk extension. Babuk is a family whose source code leaked years ago, so many unrelated groups build on it. Babuk turning up identifies nobody; it identifies that somebody reused available code.

Where the victims are, which is not where you usually read

361 unique victim IP addresses across 47 countries. The distribution breaks the assumption that these campaigns target the United States:

• Germany: 55
• United States: 41
• Turkey: 38
• Iran: 26
• France: 25

Germany leads and France is in the top five. This is not a distant campaign: it is European infrastructure, and vCenter sits at the centre of the data centre of any mid-sized company running its own virtualisation.

What to do if you administer vCenter

• Patch now. The fix has been available since 29 July. If your vCenter does not have it, it has been exposed for three weeks to something under active exploitation.
• Treat anything that was exposed as compromised. Patching shuts the door; it does not evict whoever already came through. If your vCenter was reachable and unpatched, this is a hunt, not an update.
• Get vCenter off the internet. A virtualisation management console has no business being reachable from outside. Behind a VPN or on a separate management network, this flaw stops being a remote problem.
• Check your backups. With ransomware involved, what decides the outcome is whether you hold backups the attacker could not reach.

What this one leaves behind

That the useful question is no longer "are we patched?" but "how long do we take to patch once a fix ships?". With five-day windows, a monthly update cycle is a wager, not a policy.

And that it pays to separate the counted from the assessed. That there are 361 victims is a counted fact. That a Chinese-speaking actor is behind it is a moderate-confidence judgement. Both belong in the same story; they do not carry the same weight.

If CVE identifiers and CVSS scores read as noise, we cover them in CVE vs CVSS, and what traces to look for after an intrusion in indicators of compromise.

Source: CISA Known Exploited Vulnerabilities catalog →

Frequently asked questions