Attackers are scanning VMware vCenter after critical vulnerabilities have been disclosed, with DefusedCyber’s honeypots recording elevated vCenter fingerprinting exercise. The exercise contains requests to the /sdk/ endpoint utilizing RetrieveServiceContent and exploration of the /websso single sign-on path.
The requests don’t show compromise however present that attackers are figuring out uncovered methods earlier than launching extra direct assaults.
The exercise follows Broadcom’s VMSA-2026-0006 security advisory, launched on July 29. The advisory covers 5 VMware flaws throughout vCenter, ESX, Workstation, Fusion, Cloud Basis, vSphere Basis, and Telco Cloud merchandise.
Three bugs acquired crucial rankings. Essentially the most pressing problem for vCenter directors is CVE-2026-59309, an authentication bypass in VMware Listing Service, vmdir. It has a CVSS rating of 9.8.
Hackers Scan VMware vCenter for Exploitable Flaws
A distant attacker with community entry could possibly bypass regular authentication and gain unauthorized access to the vCenter setting.
vCenter is a high-value goal as a result of it manages digital infrastructure. An attacker who controls it could possibly change virtual-machine settings, create accounts, alter community connections, entry disks, disrupt workloads, or use the platform to unfold deeper into a corporation.
The administration airplane also can maintain credentials, host particulars, backups, and details about essential enterprise methods. This makes vCenter publicity harmful for organizations working digital environments.
DefusedCyber said on X that researchers additionally identified CVE-2026-59310, a crucial listing traversal flaw within the vCenter Syslog Server that would enable network-based attackers to execute arbitrary code.
A 3rd crucial problem, CVE-2026-47876, impacts the VMXNET3 digital community adapter in ESXi. It might enable a malicious virtual-machine person to execute code on the underlying host.
Collectively, the issues can provide attackers a number of paths to succeed in delicate administration infrastructure. On the time the advisory was printed, researchers reported no public proof-of-concept code or confirmed exploitation.
The brand new scanning report ought to subsequently be handled as an early warning, not confirmation that CVE-2026-59309 is being exploited.
Scanning typically begins shortly after a crucial disclosure, as automated methods seek for weak targets. Safety groups shouldn’t anticipate public exploit code earlier than performing.
Directors ought to instantly establish each vCenter system and verify whether or not it’s reachable from untrusted networks. Broadcom’s mounted releases embody vCenter 8.0 U3k, VMware Cloud Basis and vSphere Basis 9.0.2.0100, and model 9.1.0.0300.
Organizations ought to check and deploy the related updates as rapidly as doable. There are not any recognized workarounds that change patching for these reported flaws. Defenders must also evaluation net, reverse proxy, firewall, and vCenter logs for uncommon requests to /sdk/ and /websso/.
They need to examine surprising authentication occasions, new accounts, permission adjustments, suspicious virtual-machine exercise, and unfamiliar administration connections.
Proscribing vCenter entry to permitted administrator networks, implementing multifactor authentication, and isolating administration providers can scale back publicity.
Strengthen Your SOC by Accelerating Menace Detection & Speedy Investigations. -> Integrate ANY.RUN With Your SOC Now.
