[vmware]

October 9, 2026

• A public PoC is out for CVE-2026-59346, an integer overflow in VMware's VMXNET3 virtual NIC that would let an administrator inside a guest execute code on the host. The published PoC crashes a host process rather than achieving code execution; Workstation and Fusion 25H2 and 26H1 are listed affected, with no workaround (Cyber Security News). · Vulnerabilities & Exploitation

in Third NetScaler RCE in a Month Lands on the Same SAML Surface

October 2, 2026

• Huntress reports an ESXi VM-escape exploit being used in the wild. The write-up describes observed exploitation against VMware ESXi, rather than merely a public proof-of-concept or laboratory demonstration. Huntress · Vulnerabilities & Active Exploitation

in OpenAI Disrupts a Coordinated Model-Reasoning Extraction Campaign

September 17, 2026

• CVE-2026-59310 in VMware vCenter is now flagged by CISA as used in ransomware campaigns. The CVSS 9.8 directory traversal in the vCenter Syslog server gives unauthenticated code execution and was patched by Broadcom on 29 July; QUIRSO subsequently identified more than 360 compromised IPs across 47 countries, with reverse SSH tooling planted for persistence. CISA has not named the ransomware groups, and hundreds of vCenter servers remain internet-exposed. CERT.dk, CISA KEV. · Active Exploitation

in One Extension Hijacks the AI Assistant in Five Major Browsers

September 1, 2026

• Fire Ant has expanded from VMware hypervisors into routing and authentication infrastructure, compromising Cisco IOS XR routers, TACACS servers and Linux management hosts for credential theft and security-log blinding. Sygnia found the activity after spotting a live GRE tunnel interface that appeared in neither the running config nor the commit history (Sygnia, BleepingComputer). · Threat Activity

in Attackers Are Living in the Management Plane

August 17, 2026

• VMware vCenter CVE-2026-59310 tied to China-nexus ransomware. The directory-traversal RCE under active exploitation is now attributed to a suspected China-nexus APT deploying Babuk-derived ransomware (The Hacker News) (earlier coverage). · Active Exploitation — Developing Threads

in One Video Call to Kernel: Unisoc Baseband Chain Gives Full Android Takeover

August 15, 2026

• VMware vCenter exploitation widened: Broadcom pushed VMSA-2026-0006.1, adding a critical auth-bypass (CVE-2026-59309, CVSS 9.8) and a VMXNET3 out-of-bounds write (CVE-2026-47876) alongside the directory-traversal RCE CVE-2026-59310 already under active APT exploitation for reverse-SSH persistence (Broadcom advisory, earlier coverage). · Vulnerabilities & Exploits

in A Heavy Day for Exploit Research and In-the-Wild N-Days

August 14, 2026

• Critical VMware vCenter RCE (CVE-2026-59310) is under active global exploitation. The directory-traversal flaw in the vCenter Syslog Server allows unauthenticated remote code execution, and attackers are chaining it to drop a reverse-SSH tool for persistent access — meaning patching may not fully evict an intruder who already established a foothold. Denmark's national CERT reports abuse across 47 countries. (BleepingComputer, CERT.dk) · Vulnerabilities & Exploits

in vCenter Under Active Exploitation: Critical RCE Weaponized for Reverse-SSH Persistence Across 47 Countries

July 30, 2026

• Broadcom patched critical VMware flaws including a vCenter authentication bypass (CVE-2026-59309), a Directory-Service/Syslog directory traversal (CVE-2026-59310), and an ESXi VM-escape enabling code execution on the host. No exploitation reported yet, but escape-class bugs warrant priority. The Hacker News, SecurityWeek · Vulnerabilities & Exploits

in OpenAI's Rogue Agent Widens: Four More Companies Caught in the Blast Radius