Global exploitation campaign targets critical VMware vCenter vulnerability

Security researchers have identified a global exploitation campaign targeting CVE-2026-59310, a critical vulnerability in VMware vCenter Server. Dark Reading reports that the flaw, which was disclosed earlier this month, allows attackers to execute arbitrary code remotely and gain control of virtualisation infrastructure. Exploitation began shortly after the vulnerability was made public, and researchers warn that patching alone may not be sufficient to mitigate the threat, as attackers may have already established persistence in compromised environments. VMware has released patches, but organisations are advised to review logs, check for indicators of compromise and ensure that access controls and monitoring are in place across virtualisation platforms.

Why this matters for UK organisations

This is a significant operational risk because VMware vCenter is widely used to manage virtualised infrastructure across enterprise environments, data centres and cloud platforms. A successful compromise of vCenter can give attackers control over virtual machines, storage, networking and backup systems, effectively providing access to the entire IT estate. This is particularly concerning for organisations in sectors such as healthcare, finance, manufacturing and managed services, where virtualisation platforms underpin critical business operations. The speed at which exploitation began after disclosure reflects a broader pattern in which attackers prioritise high-value infrastructure targets and move quickly to exploit newly disclosed vulnerabilities. For organisations that have not yet patched, this represents an urgent risk, and for those that have, a post-patch review is a sensible precaution to ensure that no attacker activity occurred before the patch was applied.

What to review

Organisations should ensure that VMware vCenter environments are patched urgently for CVE-2026-59310 and that post-patch reviews are conducted to check for signs of compromise. This includes reviewing recent activity logs, checking for unusual administrative activity, and confirming that no unauthorised changes have been made to virtual machines, storage or networking configurations. Organisations should also review access controls to ensure that vCenter is not exposed to the internet, that administrative access is restricted to authorised users, and that multi-factor authentication is in place. Logging and monitoring should be configured to detect unusual activity, and incident response plans should be reviewed to ensure that teams know how to respond if a compromise is detected. For organisations that rely on managed service providers to manage virtualisation infrastructure, this is also a prompt to confirm that patching has been completed and that monitoring is in place.

Source: Dark Reading