CVE-2026-59310 turns VMware vCenter into a Babuk ransomware launchpad

Early August 2026. Broadcom ships an emergency patch for CVE-2026-59310, a path-traversal bug in VMware vCenter Server rated CVSS 9.8. Five days later. Check Point Research and The Hacker News document active exploitation across 47 countries. August 19, 2026. The CISA adds the flaw to its Known Exploited Vulnerabilities catalog. In between, attackers turned the virtualization management console into a launchpad for Babuk-derived ransomware.

The danger here is not the technique. It is the target: vCenter is the single command point for an entire fleet of virtual machines, and one code execution there hands an attacker the keys to everything running behind it.

A management console worth more than a server

CVE-2026-59310 is a path traversal in vCenter Server. In practice, an attacker with plain network access to the management interface can run arbitrary code without valid credentials — no phishing first, no stolen account, just reachability.

What makes the position so valuable is architecture, not elegance. Where a compromised server yields a single machine, vCenter administers dozens or hundreds of virtual machines at once. An attacker who seizes the console inherits the whole keyring: they can shut down production workloads, exfiltrate snapshots, and — above all — trigger mass encryption without touching any individual VM.

That is exactly what makes it a more profitable ransomware target than any single host. The return on a single exploit scales with the size of the fleet it commands.

The documented playbook: reverse SSH, then Babuk

The observed sequence is mechanical. Once the console is compromised, attackers drop a reverse SSH binary to hold persistent access, then move laterally before firing the payload. The pattern is consistent enough across victims to suggest a coordinated actor or an affiliate group, rather than opportunists working from a leaked proof of concept.

The payload is Babuk-derived ransomware. Babuk first appeared in 2021, and its source code has circulated through cybercrime forums ever since, spawning a family of derivative strains run by unrelated groups. The variant in this campaign follows that lineage: it is not the original Babuk crew operating directly, but an affiliate reusing bought or leaked tooling against freshly compromised vCenter instances.

That model is now the default of the 2026 ransomware economy. Access brokers specialize in finding and weaponizing fresh CVEs, then sell the foothold to a separate crew that handles encryption and extortion. A single well-resourced broker can militarize a new CVE and sell entries to several affiliates within the same week the patch ships.

An unusually aggressive exploitation window

CVE-2026-59310 did not land in a vacuum. It arrived the same week as Microsoft’s Patch Tuesday, which fixed 421 CVEs on August 11, 2026 — including CVE-2026-68820, a use-after-free in the Windows AFD.sys driver already exploited by North Korea’s Lazarus Group against defense and aerospace targets in France, Germany, Brazil, and India.

On August 19, 2026, the CISA added four critical flaws to its KEV catalog at once: CVE-2026-59310 (vCenter), CVE-2026-68820 (Windows AFD.sys), CVE-2026-65400 (macOS Screen Sharing), and CVE-2026-55040 (Microsoft SharePoint). Four vendors, four platforms, one signal: this is not an isolated problem, but a simultaneous exploitation wave across enterprise software.

Check Point separately flagged a CVE-2026-59309 in the same product family, also at CVSS 9.8, suggesting attackers found more than one high-severity route into the same product within days. And Medusa campaigns now exceed 500 organizations worldwide, in an ecosystem where initial access trades increasingly like a commodity.

A pattern that has repeated since ESXiArgs

This is not the first time VMware virtualization has served as ransomware hunting ground. In early 2023, the ESXiArgs wave hit thousands of exposed ESXi servers worldwide by exploiting an already-patched flaw that many administrators had simply never applied. The repeating pattern is not that VMware software is unusually flawed, but that virtualization consoles are often exposed to networks with looser segmentation than the workloads they control.

The 2026 difference is the target. ESXiArgs went after the hypervisors directly; the CVE-2026-59310 campaign goes after the vCenter management layer, handing the attacker centralized control over multiple VMs at once — more leverage for a comparable exploit cost.

The patch lag is partly explained by a release cadence less predictable than Microsoft’s. The monthly Patch Tuesday gives defenders a known window for testing and rollout. Broadcom, by contrast, ships vCenter fixes as-needed, on a schedule that is harder to plan around. The result: a critical patch can land at any moment, and the teams that plan updates quarterly are exactly the ones the campaign catches.

What to do right now

The response comes down to two moves, neither of which needs a state-level budget.

• Patch without delay. Apply Broadcom’s fix for CVE-2026-59310 without waiting for a scheduled window. The ransomware campaign is already live, and every day of delay is a day of exposure to actors who automate the discovery of exposed instances.
• Segment the management interface. vCenter must not be reachable from general user networks. Restricting access to administrative subnets blunts exploitation even before patching finishes — Broadcom has published no full workaround that eliminates the flaw without the patch.
• Audit backups outside vCenter. Ransomware operators explicitly target backup infrastructure once they hold admin access. A backup managed by the same compromised vCenter is not a backup; it is an extension of the attack surface.

# Check the exposed vCenter version (from an internal segment)
nmap -p 443 --script vmware-version <vcenter-ip>

# Confirm the patched build number against Broadcom's advisory
curl -sk https://<vcenter-fqdn>/ui/ | grep -i build

# Restrict the management interface (example firewall rule)
iptables -A INPUT -p tcp --dport 443 -s <admin-subnet> -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP

Verdict

If you run VMware at scale, treat vCenter as what it has become: a high-value asset whose patch tolerates no delay. Segmenting the management interface is the highest-return control you can ship this week, and auditing backups independent of vCenter is the second priority.

If you are a smaller team, the reflex to break is the “next quarter” patch cycle. The 2023 ESXiArgs pattern — thousands of exposed servers on an already-patched flaw nobody applied — is repeating itself on the management layer in 2026. The lesson is the same: virtualization infrastructure patches like a critical attack surface, not like a workstation.

References

• VMware vCenter Zero-Day: CVE-2026-59310 Hits 47 Nations — Tech Insider, August 25, 2026
• Critical macOS, SharePoint, vCenter and more flaws added to KEV — The Hacker News, August 19, 2026
• August 2026 Patch Tuesday — Microsoft fixes 421 CVEs, one exploited zero-day — SecurityWeek
• Known Exploited Vulnerabilities Catalog — CISA
• CVE-2026-59310 — VMware vCenter Server