CISA: Critical VMware RCE flaw now exploited by ransomware gangs

CISA warned that ransomware gangs and a suspected APT have actively exploited a critical VMware vCenter directory traversal vulnerability (CVE-2026-59310) patched by Broadcom in July, with DFIR firms reporting hundreds of compromised IPs and security monitors tracking 400+ exposed vCenter servers; CISA added the flaw to its KEV catalog and ordered emergency remediation due to active abuse and high impact on enterprise environments.