Attackers are exploiting CVE-2026-59310, a severe directory-traversal vulnerability in VMware vCenter, to deploy Babuk-derived ransomware. Internet-exposed management interfaces remain a favourite ransomware entry point.
The gap between “patch available” and “patched everywhere” is precisely where ransomware crews operate.
Our analysis
vCenter is a crown-jewel target: control it and you control every VM, snapshot and backup beneath it. That is why ransomware crews weaponise vCenter bugs within days — it is the fastest route to encrypting an entire estate at once. A directory-traversal foothold here does not stay small; it becomes total. If your virtualization management plane is reachable from the internet, treat that as the emergency, independent of this specific CVE.
What you should do
- Patch vCenter and ESXi immediately, and never expose management interfaces to the internet.
- Segment and isolate the management plane; require MFA and jump hosts for administrative access.
- Maintain offline, immutable backups that ransomware cannot reach through vCenter.
- Validate your perimeter and detection with a red-team exercise, not just a vulnerability scan.
How AgentOffense helps: our external network penetration testing validates your perimeter exposure, and red team operations test whether you would actually detect and stop a real intrusion.
Source: The Hacker News / Cybersecurity Insiders.