Global Threat Campaign Exploits Critical VMware vCenter Vulnerability CVE-2026-59310

A global threat campaign exploiting a critical vulnerability in VMware vCenter Server has been active since earlier this month. The flaw, tracked as CVE-2026-59310, was publicly disclosed on August 13, 2026. According to advisories and threat intelligence, successful exploitation could allow remote attackers to gain unauthorized access and full control over affected vCenter Server systems, potentially leading to complete compromise of underlying vSphere environments.

VMware has released security updates addressing CVE-2026-59310. However, the company and independent analysts note that patching the vulnerability may not be enough to fully mitigate the active threat campaign. Additional defensive measures are advised to complement the patch and reduce the risk of compromise.

The exploitation is reported to be active globally, targeting VMware vCenter Server deployments worldwide. While details on the initial access vector and specific payloads remain under investigation, the severity of the flaw has been rated critical due to the potential impact on virtualized infrastructure. Security teams are urged to apply the available patches immediately and review supplementary guidance from VMware to harden affected systems.