CISA: Ransomware Now Exploits Critical VMware vCenter Bug

Tech-Insider • September 15, 2026

Share: View original

This website uses a security service to protect against malicious bots. This page is displayed while the website verifies you are not a bot.

Verification successful. Waiting for tech-insider.org to respond

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Ransomware Exploits Critical VMware vCenter Vulnerability CVE-2026-59310 On September 15, 2026, CISA confirmed that ransomware gangs are actively exploiting a critical remote code execution vulnerability in VMware vCenter Server, tracked as CVE-2026-59310, which has a CVSS score of 9.8. This flaw, residing in the vCenter Syslog server, allows unauthenticated attackers with network access to execute arbitrary code. Broadcom issued a patch for this vulnerability on July 29, 2026, and CISA added it to its Known Exploited Vulnerabilities catalog on August 18, 2026. Organizations running affected vCenter instances are urged to prioritize patching as the exploitation can lead to access to critical systems and sensitive data. Initial exploitation was linked to persistent access tools, but ransomware groups have now joined the attack vector. CISA has mandated federal agencies to secure their systems within three days of the advisory. The vulnerability's exploitation could potentially impact hundreds of virtual machines in enterprise environments. 6 sources 73

Extracted Entities

Attack Types (1)

Domains (1)

tech-insider.org

Platforms (1)