VMware vCenter Exploit Deploys Reverse SSH Backdoor

New campaign detail. Threat actors exploiting CVE-2026-59310 — the CVSS 9.8 authentication bypass in VMware vCenter Server — are deploying a reverse SSH tool to establish persistent remote access on compromised management planes, per BleepingComputer reporting published today. SecurityWeek reported on the active exploitation campaign separately.

What’s Changed

Previously observed: exploitation confirmation against live vCenter infrastructure (reported yesterday).

Now observed: attackers following initial exploitation with a reverse SSH deployment — an outbound tunnel from the compromised vCenter host back to attacker-controlled infrastructure. Mechanism: persistent, low-noise remote access that survives standard perimeter firewall rules (outbound SSH passes where inbound doesn’t).

Confidence: single-source (BleepingComputer); no independent technical validation published as of this writing. Treat as credible reporting, not second-source confirmed.

Why Reverse SSH

Analysis — labeled as assessment, not confirmed observation:

Reverse SSH placed inside the management plane is not inside the guest VM stack. The host running vCenter typically isn’t covered by the same EDR that watches endpoints. Network teams commonly permit outbound SSH from infrastructure nodes. After establishing initial access via the authentication bypass, a reverse SSH channel gives attackers a foothold that is:

• Durable across VM remediation — positioned at the hypervisor management layer, not inside a guest
• Low-profile — outbound traffic from infrastructure blends with normal admin patterns
• Strategically positioned — vCenter manages ESXi hosts, stored VM disk images, storage, and network fabric

Actors maintaining this position can re-enter post-remediation if only the guest layer is cleaned without addressing the management plane.

Detection and Response

If you run VMware vCenter Server:

1. Patch first. CVE-2026-59310 has had a fix available since July 29, 2026 via Broadcom advisory VMSA-2026-0006. If you’re unpatched, this is the only priority.
2. Audit outbound SSH from vCenter hosts. Check firewall logs for outbound port 22 connections from vCenter management nodes to unfamiliar external IPs, particularly after July 29.
3. Inspect SSH authorized_keys on the vCenter appliance filesystem for unauthorized entries.
4. Review vCenter appliance process list and scheduled tasks for unexpected persistent processes.
5. Isolate if unpatched. Management interfaces should be on dedicated networks, not reachable from guest VLANs or the general corporate LAN — a network-adjacent attacker is all this flaw requires.

CISA KEV status: not listed as of this writing. Active exploitation with a documented post-compromise persistence technique increases the likelihood of KEV addition — track the KEV tracker.

---

Previous coverage: vCenter Auth Bypass CVE-2026-59310 Now Exploited · CVE detail: CVE-2026-59310