Broadcom disclosed CVE-2026-59310 on August 18, a CVSS 9.8 unauthenticated path-traversal vulnerability in vCenter's rsyslog templating that lets a remote attacker with network access to the appliance write arbitrary files anywhere on the filesystem and, chained with a service restart, achieve code execution as root. Within days, independent researchers tracked at least 361 compromised vCenter appliances across 47 countries, most reached through reverse SSH tunnels planted by the same syslog abuse the advisory describes. There is no workaround: Broadcom's guidance is patch immediately or take the syslog receiver offline. For Swiss organisations, the timing matters as much as the severity. vCenter is the control plane for the overwhelming majority of enterprise, hospital, and cantonal-administration virtualisation estates in the country, and a single compromised appliance does not stay contained to one virtual machine — it is a foothold into every workload the hypervisor layer touches.
How the exploit chain actually works
The root cause sits in a default rsyslog template that vCenter ships to generate per-host log file paths: /var/log/vmware/esx/%hostname%/%hostname%-syslog.log. The %hostname% value is populated from the syslog message itself and is never sanitised for path-traversal sequences or control characters. An attacker who can reach the appliance's syslog listener — over UDP 514 by default, sometimes proxied through management networks that are assumed trusted — can submit a crafted hostname containing ../ sequences to escape the intended log directory entirely. Because rsyslog also fails to escape embedded newlines, the same crafted message can span multiple lines, letting an attacker construct the contents of an arbitrary file rather than just its path. Combine the two primitives and you can drop a script into a location vCenter will execute on its next service reload, cron cycle, or appliance restart — no credentials, no prior foothold, and no user interaction required.
Some observed intrusions layer a second flaw, CVE-2026-59309, an authentication bypass in the same advisory, to skip straight to an authenticated session before deploying the reverse-shell tooling. That chaining is an accelerant, not a prerequisite: CVE-2026-59310 alone is sufficient for full compromise, which is why CISA added it to the Known Exploited Vulnerabilities catalog with a federal remediation deadline of August 21 — the same day this analysis is published.
Why Swiss virtualisation estates are structurally exposed
Switzerland's data-centre footprint leans heavily on VMware Cloud Foundation and vSphere Foundation across banking, insurance, hospital, and federal environments — the same product lines named in Broadcom's advisory alongside standalone vCenter. Two structural factors raise the stakes locally. First, vCenter management interfaces are frequently reachable from broad internal network segments rather than isolated management VLANs, a legacy of environments built before zero-trust segmentation became standard practice; a syslog listener that "only" needs internal network reachability is not much of a barrier in that topology. Second, consolidation is the point of virtualisation: a single ESXi cluster commonly hosts workloads spanning multiple regulatory domains — a bank's core ledger next to a marketing CMS, a hospital's PACS system next to an HR portal — so a root-level vCenter compromise is rarely a contained incident. It is, by design, a blast radius that spans however many business units share that infrastructure.
The FINMA and ISA operational-resilience lens applies directly here. Both frameworks require regulated entities to identify critical functions and the infrastructure dependencies underneath them; vCenter rarely appears on those dependency maps as a named critical asset, because it is treated as commodity management tooling rather than the single point of failure it actually is for everything running on top of it. This incident is the argument for adding vCenter, and equivalent hypervisor management planes, explicitly to critical-function dependency inventories.
Detection is harder than patching
Patching closes the door going forward, but it does not answer whether an appliance was already compromised during the roughly three-week window between the syslog abuse becoming exploitable and today's public disclosure. Because the attack technique writes files through a logging pipeline rather than a conventional exploit payload, standard IOC signatures built around known malware hashes are unreliable — the observed campaigns favour living-off-the-land reverse SSH tunnels rather than dropped binaries. Swiss security teams should treat any internet-reachable or broadly-segmented vCenter appliance as presumed-compromised until an integrity check proves otherwise, not merely presumed-vulnerable until patched.
◆ Key Takeaway
CVE-2026-59310 turns a logging feature into an unauthenticated root-access primitive against vCenter, the control plane for most Swiss virtualisation estates. Patching alone is insufficient — every appliance reachable from a broad network segment during the exploitation window needs an integrity investigation, not just an update.
- Apply Broadcom's patched vCenter builds immediately; there is no supported workaround for CVE-2026-59310.
- Restrict syslog listener access (UDP/TCP 514 and any configured TLS syslog port) to a dedicated, firewalled management segment — not general internal network reachability.
- Audit rsyslog configuration and log directories on every vCenter appliance for unexpected files, directories with traversal sequences in their names, or recently modified startup scripts.
- Hunt for outbound reverse SSH tunnels or unexplained persistent connections originating from vCenter appliances, a signature technique in the observed campaigns.
- Rotate any credentials and API tokens stored in or accessible from a vCenter instance that was reachable from an untrusted segment during the exploitation window.
- Add hypervisor management planes explicitly to FINMA/ISA critical-function dependency inventories rather than treating them as generic infrastructure.
- Confirm CVE-2026-59309 (authentication bypass) is also patched, since observed intrusions chain it with CVE-2026-59310 to skip directly to an authenticated session.
Vendors will keep shipping management-plane software that trusts the data it logs, and attackers will keep finding the gap between "logging" and "input validation." The lesson from CVE-2026-59310 is not specific to VMware: any component that sits below the workloads it manages — hypervisors, orchestrators, configuration management systems — deserves the same scrutiny as a production application, including input validation review and network isolation, rather than the implicit trust that comes with being infrastructure rather than an app.