CISA says ransomware gangs are now using the vCenter bug patched in July

vCenter is the console that tells every ESXi host what to do. When that box falls, the rest of the virtual estate is a spreadsheet of targets. CISA confirmed on September 15 that ransomware gangs have joined attacks against CVE-2026-59310, a critical directory traversal in the vCenter Syslog server that Broadcom patched on July 29.

What changed today

The bug itself is not new. It is unauthenticated remote code execution through a component that ships on most vCenter deployments. CVSS 9.8. Network access to the Syslog service is enough. No login. No user click.

Early reporting in August pointed to a suspected China-nexus actor planting remote-access tools, including reverse SSH style implants. QUIRSO and later Nopal Cyber described hundreds of compromised addresses across dozens of countries. Some later-stage activity was tied to Babuk-derived ransomware landing on ESXi hosts managed by those vCenter instances. CISA's September 15 KEV update is the official shift from "espionage is using this" to "ransomware gangs are using this too."

CISA has not named a brand in that update. You do not need a brand name to know what happens next. Hypervisor ransomware skips endpoint agents. Encrypt the datastore and the guests go dark together.

Why vCenter keeps showing up on leak sites

One compromised management server can expose credentials, snapshots, and API access across dozens of virtual machines. Segmentation often fails here because vCenter has to talk to every host it manages, so it sits on a network that looks "internal" and therefore safe. It is not safe if the Syslog port is reachable from anywhere an attacker already is, or worse, from the internet.

This is the same structural problem as the ESXiArgs wave years ago and the ESXi sandbox-escape abuse CISA flagged earlier in 2026. The patch exists. The unpatched population stays large enough that opportunistic crews find it.

What we would do this week

• Confirm vCenter build. Fixed trains reported in public advisories include 9.1.0.0300, 9.0.2.0100, and 8.0 U3k or U2f depending on branch. Anything on 7.x still in production is a special problem.
• Check whether the Syslog service is reachable beyond the management VLAN. If it is on the internet, treat that as an incident until logs say otherwise.
• Hunt for unexpected admin accounts, SSH persistence, and new VIB or script activity on managed ESXi hosts since late July.
• Snapshot and backup strategy only helps if backups are offline or immutable. Ransomware crews that own vCenter will look for the backup jobs next.
• Document patch evidence for insurance. KEV-listed and unpatched is a conversation you do not want after an outage.

Bottom line

A July patch becoming a September ransomware warning is the usual story: management planes wait in the change calendar while attackers do not. Forensic Five reviews external exposure and virtualization-adjacent configuration for Canadian organizations that need a written, scoped read. From St. Albert, Alberta. We say what we can verify and stop there.