Ransomware Exploits Critical VMware vCenter Vulnerability CVE-2026-59310

• •CVE-2026-59310 is a critical vulnerability in VMware vCenter with a CVSS score of 9.8.
• •Ransomware gangs are actively exploiting this flaw, increasing risks for unpatched systems.
• •CISA has mandated a three-day patching deadline for federal agencies to secure affected systems.

On September 15, 2026, CISA confirmed that ransomware gangs are actively exploiting a critical remote code execution vulnerability in VMware vCenter Server, tracked as CVE-2026-59310, which has a CVSS score of 9.8. This flaw, residing in the vCenter Syslog server, allows unauthenticated attackers with network access to execute arbitrary code. Broadcom issued a patch for this vulnerability on July 29, 2026, and CISA added it to its Known Exploited Vulnerabilities catalog on August 18, 2026. Organizations running affected vCenter instances are urged to prioritize patching as the exploitation can lead to access to critical systems and sensitive data. Initial exploitation was linked to persistent access tools, but ransomware groups have now joined the attack vector. CISA has mandated federal agencies to secure their systems within three days of the advisory. The vulnerability's exploitation could potentially impact hundreds of virtual machines in enterprise environments.