Ransomware gangs now linked to exploitation of critical VMware vCenter flaw
SecurityUnverifiedUpdated:
A critical VMware vCenter vulnerability already reported as actively exploited is now flagged as being used by ransomware gangs, according to a report describing a CISA catalog update.
Ransomware use reportedly added to the CISA catalog
BleepingComputer reported that CISA updated its Known Exploited Vulnerabilities catalog over the weekend to flag CVE-2026-59310 as actively abused by ransomware gangs. Broadcom had patched the critical VMware vCenter Syslog server directory-traversal flaw on July 29; the flaw can reportedly allow unauthenticated attackers to execute arbitrary code.
Before this update, the vulnerability had already been described as under active exploitation, and CISA had added it to its Known Exploited Vulnerabilities catalog.
CISA's catalog was reportedly updated to identify ransomware gangs as users of the VMware vCenter flaw, broadening the reported set of attackers abusing it.
The report does not describe exploitation starting for the first time. It adds ransomware use to attacks already reported as ongoing, making the threat context more specific for affected vCenter operators.
Sources
- BleepingComputerCISA: Critical VMware RCE flaw now exploited by ransomware gangsRead source →