Wave of scans target critical VMware vCenter vulnerabilities
- Thảo Nguyên
- 6 days ago
- 2 min read
Cybersecurity experts have recently detected a sharp surge in scanning activity targeting VMware vCenter systems. This serves as an early warning signal that threat actors are actively hunting for unpatched targets in preparation for dangerous intrusion attempts.
Probing wave follows security advisory
Data from DefusedCyber's honeypots shows malicious actors continuously sending probe requests to paths such as /sdk/ (via the RetrieveServiceContent) and /websso (the single sign-on system). This activity aims to identify exposed, unprotected vCenter servers. While these queries do not necessarily mean a system has been compromised, they serve as a pre-attack warning sign of potential risk.
This scanning activity erupted shortly after Broadcom released security advisory VMSA-2026-0006 on July 29. The advisory addresses five vulnerabilities across multiple product lines, including vCenter, ESX, Workstation, Fusion, Cloud Foundation, vSphere Foundation, and Telco Cloud, with three flaws classified as critical severity.
Threats from high-severity flaws
Most concerning is CVE-2026-59309, an authentication bypass vulnerability in the VMware Directory Service (vmdir) with a CVSS score of 9.8/10. Successful exploitation allows a remote attacker with network connectivity to gain unauthorized access to vCenter without undergoing standard login authentication. Because vCenter serves as the central management console for the entire virtualization infrastructure, losing control of this platform enables attackers to manipulate virtual machines, create new accounts, modify network configurations, access sensitive data, or disrupt the entire infrastructure.
The advisory also highlights two other critical vulnerabilities:
CVE-2026-59310: A directory traversal flaw in the vCenter Syslog Server that enables attackers to execute arbitrary code remotely over the network.
CVE-2026-47876: A security flaw in the VMXNET3 virtual network adapter on ESXi, allowing a malicious actor inside a virtual machine to execute unauthorized code directly on the host hypervisor.
Although there were no public proof-of-concept (PoC) exploits or evidence of active exploitation at the time of publication, the current scanning activity is a signal that system administrators cannot afford to ignore.
Recommended actions for administrators
Rather than waiting for a public exploit to emerge, operations teams should proactively identify all vCenter instances and block incoming connections from untrusted networks. The most effective mitigation is to promptly update to the patched versions released by Broadcom, including vCenter 8.0 U3k, as well as VMware Cloud Foundation and vSphere Foundation versions 9.0.2.0100 and 9.1.0.0300.
In parallel with upgrading, security teams should review web logs, reverse proxies, firewalls, and vCenter logs for anomalous requests targeted at /sdk/ or /websso/. Investigating unusual authentication events, newly created accounts, privilege modifications, and unfamiliar administrative connections—alongside restricting vCenter access strictly to management networks and enforcing multi-factor authentication (MFA) - will significantly reduce the risk of compromise.
Proactively deploying patches and hardening defensive layers right now is the only way organizations can secure their virtualized environments against impending threats.
References:
ADSEC Vietnam: Critical CVE vulnerability: VMware vCenter under attack
Comments