Patched VMware vCenter bug targeted in ransomware campaigns

The Cybersecurity and Infrastructure Security Agency (CISA) on Sept. 14 warned that a VMware vCenter directory traversal bug patched on July 29 was now under attack by ransomware groups.

Security pros couldn’t help but take note of the speed with which this case moved to the ransomware phase — about seven weeks — and said teams should get prepared for even more compressed timelines.

Denis Calderone, chief technology officer at Suzu Labs, said the early activity around CVSS 9.8 CVE-2026-59310 looked like espionage where we saw reverse SSH tunnels for persistence and quiet access across 47 countries. Now, Calderone said ransomware operators are ending the attack chain specifically with Babuk-derived payloads encrypting ESXi virtual machines. 

Calderone said speed was the story in this case: Broadcom patched July 29, Quirso confirmed active exploitation by Aug. 3, CISA added it to its known exploited vulnerabilities (KEV) catalog a few days later, and now we're looking at ransomware deployment.

“Five days from patch to exploitation, six weeks from exploitation to ransomware,” said Calderone. “That window keeps compressing, and organizations that treat patching as a next-maintenance-cycle activity are getting caught in it.”

John Strand, owner at Black Hills Information Security, insisted that this incident “screams” AI-assisted exploit development.

“The timeline between vulnerability disclosure, patch availability, and active exploitation keeps getting shorter,” said Strand. “We’re reaching a point where some organizations may not even have enough time to fully test patches before exploits start hitting.”

Strand said organizations must increase their tolerance for doing things that hurt, including patching immediately. For years, Strand said the standard approach was to roll patches through staging and testing before they ever touch production.

“That makes sense when you have time,” said Strand. “We may not have that luxury anymore.”

Attackers are scanning huge portions of the internet, cataloging what technologies organizations are running, and waiting for exploits to become available, said Strand. When an exploit drops, they can immediately start working through that inventory.

“We may simply not have the time to test and validate patches the way we used to,” said Strand.

Organizations also need to ask why some of these systems are exposed to the internet at all: if a service only needs to be available to employees, put it behind a VPN, an access service such as Cloudflare, or another private access technology, said Strand.

Lydia Zhang, president at Ridge Security, added that although these vulnerabilities require no authentication, an attacker must have network access to the affected vCenter services. Zhang said restricting management interfaces to trusted networks and administrator jump hosts reduces internet-based exposure, but it does not protect against an attacker who has already breached the network.

“Given the speed of exploitation, teams should treat patching as an emergency change, identify every vCenter instance, apply the latest cumulative update, and remove direct internet access,” said Zhang. “They should also investigate previously vulnerable systems for unexpected accounts, processes, scheduled tasks, outbound connections, or ESXi changes. If the team suspects compromise, isolate affected systems, preserve evidence, and rotate privileged credentials after containment.”