Bottom line: A suspected Chinese APT group is actively exploiting the critical vCenter vulnerability CVE-2026-59310 (CVSS 9.8) to distribute Babuk-based ransomware.
Security researchers have attributed the exploitation of a recently patched vulnerability in Broadcom VMware vCenter to a suspected Chinese APT group. The vulnerability in question is CVE-2026-59310, a critical directory traversal flaw with a CVSS score of 9.8.
The vulnerability CVE-2026-59310 affects Broadcom’s VMware vCenter Server and allows attackers to execute arbitrary code on the affected system via directory traversal. With a CVSS score of 9.8, the flaw falls into the highest criticality tier. Security researchers have observed attacks in which the vulnerability has already been actively exploited, attributing this campaign to a suspected China-linked advanced persistent threat actor. As part of these attacks, ransomware based on the well-known Babuk code was deployed.
vCenter servers serve as the central management tool for VMware virtualization environments and thus represent a highly sensitive attack surface: a successful compromise potentially enables control over entire virtualized infrastructures, including all virtual machines running on them. For organizations with VMware-based data centers, this poses a significant risk, since a single successful exploit can lead to extensive lateral movement opportunities and, in this case, the encryption of critical systems via ransomware.
CISOs should immediately verify whether the affected vCenter versions are deployed within their own environment and prioritize applying the patches provided by Broadcom. Since the vulnerability is already being actively exploited in the wild, it is also advisable to review system logs for indicators of compromise and to restrict network access to vCenter management interfaces where immediate patching is not possible.
Source: thehackernews.com · Published August 17, 2026
Lumi AI News — AI-assisted curation in accordance with Art. 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.8.3.