VMware vCenter China-Nexus APT Actively Exploiting Directory Traversal to Deploy Babuk Ransomware on ESXi Hosts (CVE-2026-59310)

Scope: VMware vCenter Server All Versions Prior to VMSA-2026-0006.1 Patched Releases

Severity: Red

German incident response firm QUIRSO confirmed this week that a suspected China-nexus APT began exploiting CVE-2026-59310 (CVSS 9.8), a critical directory traversal vulnerability in the VMware vCenter Syslog Server, just five days after Broadcom publicly disclosed the patch on July 29, 2026, with 361 victim IP addresses now confirmed across 47 countries. The attacker gains immediate root-level code execution on the vCenter appliance without authentication, then establishes persistence through malicious cron jobs impersonating legitimate VMware services, deploys web shells, creates rogue vSphere admin accounts, and ultimately deploys a Babuk-derived ransomware that encrypts ESXi host files with the .babyk extension, likely as a smokescreen to destroy forensic evidence of the primary intrusion. Organizations that have not yet applied VMSA-2026-0006.1 must do so immediately, audit vCenter for unauthorized administrator accounts and unexpected cron jobs in /etc/cron.d, and check ESXi hosts for .babyk encrypted files as an indicator of full compromise.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.