CISA: Critical VMware RCE flaw now exploited by ransomware gangs

A critical directory traversal vulnerability in VMware vCenter (CVE-2026-59310) is being actively exploited by ransomware groups, allowing unauthenticated attackers to execute arbitrary code on affected systems. Despite a patch being available since July, many organizations failed to apply it in a timely manner, leaving their virtualization infrastructure — often the backbone of enterprise environments — exposed. This gap between patch availability and patch deployment is a recurring and dangerous pattern, as threat actors actively monitor public vulnerability disclosures to target slow-moving organizations. The consequences of a compromised vCenter environment are severe, since attackers can pivot to every virtual machine under its management, amplifying ransomware impact across the entire infrastructure.