VMware vCenter Zero-Day: CVE-2026

Nadia Dubois
August 25, 2026
11 min read

A single flaw in VMware vCenter has turned into one of the more consequential enterprise-security stories of August 2026. Tracked as CVE-2026-59310, the directory-traversal bug carries a CVSS score of 9.8 out of 10 and is now confirmed as actively exploited across data centers in 47 countries, according to threat intelligence gathered by Check Point Research and The Hacker News. Attackers are using it to drop reverse SSH binaries on compromised vCenter servers, then pivoting to deploy Babuk-derived ransomware. The campaign lands in the same week Microsoft shipped fixes for 421 CVEs on its August Patch Tuesday, including a Windows zero-day already weaponized by North Korea’s Lazarus Group. Together, these disclosures paint a picture of an unusually aggressive exploitation window for enterprise infrastructure this month.

Don’t miss new tech stories on Google

Add Tech Insider once in the Google app and our stories appear in your news suggestions.

What Is CVE-2026-59310 and Why It Matters

CVE-2026-59310 is a path-traversal vulnerability in VMware vCenter Server, the management console that IT teams use to run virtual machines across enterprise data centers. Broadcom, which owns VMware, disclosed the flaw earlier in August, but researchers say attackers had a working exploit chain within five days of the advisory going public. That turnaround is fast even by 2026 standards, where the average time between disclosure and mass exploitation has been shrinking for several years running.

The bug allows an attacker with network access to vCenter to execute arbitrary code without needing valid credentials first. Because vCenter typically sits at the center of an organization’s virtualization stack, compromising it can hand an attacker control over dozens or hundreds of virtual machines at once. That is precisely what makes vCenter such an attractive ransomware target compared with attacking individual servers one at a time.

Once inside, the attackers documented in this campaign drop a reverse SSH binary to maintain persistent access, then move laterally before triggering a Babuk-style ransomware payload. The Hacker News reported the pattern was consistent enough across victim organizations to suggest a single coordinated actor or affiliate group, rather than opportunistic copycats working from a leaked proof-of-concept.

The Babuk Ransomware Connection

Babuk ransomware first surfaced in 2021 and its source code has circulated among cybercrime forums ever since, giving rise to a family of derivative strains used by unrelated groups. The variant deployed in the vCenter campaign follows that lineage: it is not the original Babuk group operating directly, but an affiliate using leaked or purchased Babuk tooling against freshly compromised vCenter instances. This is a familiar pattern in 2026’s ransomware economy, where access brokers sell footholds into enterprise networks and separate crews handle encryption and extortion.

The timing also overlaps with a separate and unrelated incident: Colombia’s Ministry of Justice suffered a ransomware attack in mid-August that disrupted technology infrastructure tied to illicit-drug monitoring and legal case processing, according to Check Point’s weekly threat brief. While that attack has not been publicly linked to CVE-2026-59310, it illustrates how ransomware operators are increasingly targeting government and critical-infrastructure systems rather than sticking to easier private-sector marks.

August 2026 Patch Tuesday: 421 CVEs, One Confirmed Zero-Day

Microsoft’s August 2026 Patch Tuesday, released August 11, addressed 421 CVEs in total, according to SecurityWeek’s coverage of the release. Of those, one was confirmed as exploited in the wild before the patch shipped: CVE-2026-68820, a use-after-free flaw in the Windows Ancillary Function Driver for WinSock (afd.sys), the kernel-mode component that handles low-level network socket operations.

CrowdStrike’s Patch Tuesday analysis counted three additional zero-days that were publicly disclosed but not yet observed in active attacks, alongside 62 vulnerabilities rated Critical and 349 of lower severity, per the CrowdStrike Patch Tuesday breakdown. CVE-2026-68820 carries a CVSS 3.1 base score of 7.0, which is moderate on paper, but the local-privilege-escalation nature of the bug makes it dangerous when chained with a separate initial-access vulnerability like a phishing payload or a browser exploit.

The Cybersecurity and Infrastructure Security Agency added CVE-2026-68820 to its Known Exploited Vulnerabilities catalog with an “Immediate” remediation label and a patch deadline of August 25, 2026, the same day this article publishes. Federal civilian agencies operating under Binding Operational Directive requirements were required to patch by that date. Qualys researchers flagged the deadline directly in their Patch Tuesday security update review.

Lazarus Group’s Role in the Windows Zero-Day

Security researchers have attributed exploitation of CVE-2026-68820 to North Korea’s Lazarus Group, which reportedly used the AFD.sys flaw to deliver a new backdoor targeting defense and aerospace companies in France, Germany, Brazil, and India. That targeting pattern is consistent with Lazarus’s long-running interest in intellectual property tied to weapons systems and aerospace engineering, a focus that has defined the group’s operations since at least the mid-2010s. The use of a genuine zero-day, rather than a known and already-patched vulnerability, signals the group retains meaningful in-house exploit development capacity even after years of sanctions and public exposure.

The Broader August KEV Catalog Expansion

CVE-2026-59310 and CVE-2026-68820 did not arrive in isolation. CISA added four critical vulnerabilities to its Known Exploited Vulnerabilities catalog on August 19 alone, according to The Hacker News’ report on the KEV additions. The batch spans four different vendors and platforms, underscoring that this is not a single-vendor problem but a broad wave of exploitation hitting enterprise software simultaneously.

Two of these, CVE-2026-59309 and CVE-2026-59310, were flagged together in Check Point’s early-August threat intelligence report as both carrying CVSS scores of 9.8, a rare occurrence that suggests attackers found more than one high-severity route into the same product family within days of each other. Cisco also confirmed a separate CVE-2026-20316 vulnerability in its Secure Firewall Management Center was under active exploitation, adding yet another enterprise network vendor to the list of August’s active-exploitation targets.

Medusa Ransomware and the Wider Exploitation Landscape

Ransomware activity tied to this exploitation wave is not limited to Babuk-derived attacks on vCenter. Daily threat publications from August 24 report that Medusa ransomware campaigns have now impacted more than 500 organizations globally, a figure that has been climbing steadily through 2026 as Medusa affiliates adopt double-extortion tactics that combine encryption with data-leak threats published on dedicated shame sites.

The overlap between Medusa’s growth and the vCenter and Windows exploitation chains is not coincidental in the eyes of most incident responders. Ransomware crews increasingly buy initial access from specialist brokers who focus purely on finding and exploiting fresh CVEs like CVE-2026-59310, then hand off the compromised environment to a separate encryption crew. That division of labor is part of why patch timelines have compressed so sharply: a single well-resourced access broker can weaponize a new CVE and sell footholds to multiple ransomware affiliates within the same week a patch ships.

Market and Enterprise Impact

For enterprises running VMware virtualization at scale, the vCenter exploitation wave forces an uncomfortable choice: patch immediately and risk downtime during a maintenance window, or delay and risk a ransomware event that can take an entire virtualized data center offline. Broadcom’s acquisition of VMware in 2023 already pushed many customers toward subscription licensing and consolidated support contracts, and this incident adds pressure on IT leadership to accelerate patch-management automation rather than relying on manual quarterly cycles.

Cybersecurity vendors with exposure to vulnerability management, endpoint detection, and cloud workload protection stand to benefit from the renewed urgency. CrowdStrike, Qualys, and Tenable have all published Patch Tuesday breakdowns this month positioning their platforms as the fastest path to identifying exposed vCenter and Windows AFD instances across hybrid environments. Security budgets that were already trending toward attack-surface management tools in 2026 are likely to see this incident cited directly in renewal and expansion conversations.

Insurance underwriters are watching closely too. Ransomware claims tied to unpatched, internet-facing management consoles like vCenter have historically triggered exclusions or higher premiums in cyber-insurance policies, and a documented 47-country exploitation campaign gives underwriters fresh data to justify tighter patch-compliance requirements as a condition of coverage.

Historical Context: A Pattern of vCenter Exploitation

This is not the first time vCenter has been a high-value ransomware target. VMware’s ESXi hypervisor and vCenter management layer have been repeat targets since the ESXiArgs ransomware wave in early 2023, which hit thousands of exposed ESXi servers worldwide by exploiting an older, already-patched vulnerability that many administrators had simply never applied. The pattern that keeps repeating is not that VMware software is unusually flawed, but that virtualization management consoles are frequently exposed to networks with looser segmentation than the workloads they control, and patch cycles for infrastructure software tend to lag behind those for endpoint operating systems.

Compare that to Microsoft’s Patch Tuesday cadence, which has become the default rhythm the entire security industry plans around. Even with 421 CVEs addressed in a single August release, Microsoft’s monthly cycle gives defenders a predictable window to test and deploy fixes. VMware and other enterprise infrastructure vendors do not always follow the same monthly cadence, which means critical vCenter patches can arrive on an unpredictable schedule that is harder for IT teams to plan around.

Competitive Landscape: How Vendors Are Responding

The response across the enterprise security industry has been swift but uneven. Broadcom pushed an emergency patch for CVE-2026-59310 and published a VMware Security Advisory (VMSA) with mitigation guidance for customers who cannot patch immediately, including network segmentation recommendations to restrict vCenter management interfaces from general corporate networks. Microsoft, by contrast, folded CVE-2026-68820 into its existing monthly Patch Tuesday cycle rather than issuing an out-of-band emergency update, a decision some researchers criticized given the confirmed Lazarus Group exploitation.

Cisco’s handling of CVE-2026-20349, the Secure Firewall ASA/FTD zero-day, drew particular scrutiny because the company confirmed no full workaround exists short of applying the patch, according to Sovereign GRC’s weekly cyber risk brief covering the August 10-16 window. That leaves organizations running affected firewall hardware with limited options beyond accelerating patch deployment, even during periods when change-control processes would normally slow things down.

What Security Teams Should Do Right Now

Incident responders tracking this cluster of vulnerabilities recommend a consistent set of immediate actions. First, confirm vCenter Server version and apply Broadcom’s patch for CVE-2026-59310 without waiting for a scheduled maintenance window, given the confirmed ransomware deployment already underway. Second, restrict network access to vCenter management interfaces so they are not reachable from general user networks, a mitigation that blunts exploitation even before patching completes.

Third, apply Microsoft’s August cumulative update to address CVE-2026-68820, prioritizing systems in defense, aerospace, and government sectors given the confirmed Lazarus Group targeting. Fourth, review SharePoint, IKE Service Extensions, and macOS Screen Sharing configurations against the four vulnerabilities CISA added to its KEV catalog on August 19, since all four were confirmed under active exploitation at the time of listing. Fifth, audit backup and recovery procedures independent of the primary vCenter environment, since ransomware operators specifically target backup infrastructure once they have administrative access to virtualization management consoles.

# Quick vCenter exposure check (run from an internal network segment)
nmap -p 443 --script vmware-version <vcenter-ip>

# Confirm patched build number against Broadcom's advisory
curl -sk https://<vcenter-fqdn>/ui/ | grep -i build

# Restrict management interface exposure (example firewall rule)
iptables -A INPUT -p tcp --dport 443 -s <trusted-admin-subnet> -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP

Predictions: Where This Exploitation Wave Goes Next

Based on the pattern of exploitation seen through late August, several outcomes look likely over the coming weeks. First, expect the 47-country exploitation count for CVE-2026-59310 to keep climbing through early September as slower-patching organizations get discovered by automated scanning tools that ransomware affiliates run continuously against exposed vCenter interfaces.

Second, additional Babuk-derived ransomware variants will likely surface using the same vCenter access technique, since leaked ransomware builders make it triain once it is public knowledge. Third, CISA is likely to add at least two or three more CVEs from this same August disclosure wave to its KEV catalog before September, given the pace of additions already seen this month

Fourth, expect Broadcom to face renewed pressure from enterprise customers to publish a predictable, Patch-Tuesday-style release cadence for VMware security updates, rather than the current as-needed model that leaves administrators guessing when the next critical fix will land. Fifth, cyber-insurance carriers will likely begin explicitly asking policyholders about vCenter patch status during renewal underwriting, following the same pattern that emerged after the 2023 ESXiArgs wave reshaped how insurers evaluated hypervisor exposure.

Frequently Asked Questions

What is CVE-2026-59310?
It is a critical path-traversal vulnerability in VMware vCenter Server, rated CVSS 9.8, that allows an attacker with network access to execute arbitrary code without valid credentials.

Is CVE-2026-59310 being actively exploited?
Yes. Researchers have documented exploitation across 47 countries, with attackers dropping reverse SSH binaries for persistence before deploying Babuk-derived ransomware.

What is CVE-2026-68820 and how does it relate to this campaign?
CVE-2026-68820 is a separate Windows zero-day in the Ancillary Function Driver for WinSock, patched during Microsoft’s August 2026 Patch Tuesday. It is not directly linked to the vCenter attacks, but it was disclosed in the same week and has been tied to Lazarus Group activity against defense and aerospace targets.

How many vulnerabilities did Microsoft patch in August 2026?
Microsoft addressed 421 CVEs in its August 2026 Patch Tuesday release, including 62 rated Critical and one confirmed zero-day exploited in the wild.

What should organizations running VMware vCenter do immediately?
Apply Broadcom’s patch for CVE-2026-59310 without delay, restrict network access to vCenter management interfaces, and audit backup infrastructure independently in case administrative access has already been compromised.

Is there a workaround if I cannot patch vCenter immediately?
Network segmentation that restricts vCenter management interfaces to trusted administrative subnets reduces exposure, but Broadcom has not published a full workaround that eliminates the vulnerability without patching.

What ransomware group is behind the vCenter attacks?
The payload is a Babuk-derived variant, meaning it uses leaked or purchased Babuk ransomware tooling rather than being operated by the original Babuk group. This is consistent with the access-broker model common across 2026 ransomware operations.

How does this compare to the 2023 ESXiArgs ransomware wave?
Both incidents targeted VMware virtualization infrastructure through an unpatched vulnerability, but ESXiArgs hit ESXi hypervisors directly while the 2026 campaign targets vCenter’s management layer, giving attackers centralized control over multiple virtual machines at once.

Related Coverage

For broader coverage of this year’s threat landscape, see the cybersecurity threats 2026 hub.