Suspected China-Nexus APT Weaponizes CVE-2026-59310

CVE-2026-59310 is a critical directory traversal vulnerability in the VMware vCenter Syslog server that allows an attacker with network access to the appliance to execute arbitrary code, and it is being exploited at a global scale by a suspected China-nexus advanced persistent threat actor. Broadcom disclosed the flaw on July 29, 2026, in advisory VMSA-2026-0006 alongside CVE-2026-59309, an authentication bypass in the VMware Directory Service, and stated that no workaround exists.

Exploitation began five calendar days later. The first compromised systems connected to actor infrastructure on August 3, 2026, with the campaign expanding sharply on August 4 when 151 additional victim IP addresses appeared and reaching 343 of an eventual 361 unique victim IP addresses by August 5. Those 361 addresses span 47 countries, concentrated in Germany with 55, the United States with 41, Turkey with 38, Iran with 26, and France with 25, and cluster by sector in technology, software and cybersecurity, followed by higher education and research, and then telecommunications.

The observed intrusion chain abuses the syslog path-handling behavior to write actor-controlled content into /etc/cron.d, giving the actor immediate non-interactive code execution as root on the vCenter Server Appliance without any prior authentication event. From there, the actor stages the linuxFile WebSocket backdoor and the open-source reverse_ssh framework, plants a JSP webshell inside the vCenter Perfcharts application, grants the perfcharts service account passwordless sudo, harvests the vCenter machine account credential from the vmdir registry hive, creates multiple vSphere SSO administrator accounts, and ultimately deploys Babuk-derived ransomware against ESXi hosts.

With moderate confidence the operator is a Chinese-speaking actor probably working in a UTC+8 environment, based on Simplified Chinese artifacts in attacker scripts, apparent reuse of research from a Chinese security publication, repeated use of Chinese-language tooling, victimology that excludes mainland China, and activity patterns consistent with UTC+8 working hours — while noting insufficient evidence to associate the campaign with a named Chinese threat group or to determine state direction.

The root cause is insufficient constraints on pathnames handled by the vCenter Server Appliance syslog service, which allows relative traversal sequences supplied in log data to escape the configured syslog output directory. Recovered log entries preserve the exploit format, in which a traversal string of the form ../../../../etc/cron.d/zz-poc59310 appears embedded in a malformed syslog record accompanied by a crontab-formatted payload line and a fabricated timestamp dated to January 2026.

The effect is that actor-controlled content is written into a privileged execution location. Because the syslog service runs with sufficient privilege on the appliance, the resulting file is picked up and executed by the cron daemon in a root context, converting what is nominally a file write primitive into unauthenticated remote code execution as root against CVE-2026-59310.