vCenter Flaw Exploited Just Five Days After Disclosure

A critical VMware vCenter Syslog server directory traversal vulnerability (CVE-2026-59310, CVSS 9.8) was exploited in the wild within five days of Broadcom's advisory; incident responders at Quirso attributed the campaign to a suspected APT, observed 361 victim IPs across 47 countries, and found attackers deploying the open-source reverse_ssh reverse shell for persistence. Fixed vCenter releases are available, but organizations must both patch and actively evict pre-patch access.