CVE-2026-59310 Path Traversal Enables Reverse SSH Cron Persistence on 361 vCenter Hosts

QUIRSO identified the campaign during incident response after observing path traversal consistent with the flaw, followed by installation of a cron job establishing outbound reverse SSH to attacker infrastructure. Contact with malicious domains began five days after Broadcom's disclosure, with victims concentrated in Germany, the United States, Turkey, Iran, and France. The activity produced confirmed compromises rather than mere scanning attempts.

Forensic artifacts include unauthorized cron entries and unexpected outbound connections on vulnerable appliances. QUIRSO explicitly separated this intrusion set from concurrent scanning observed by Defused Cyber against CVE-2026-59309. No technical indicators link the two efforts at present.

The reverse_ssh tool matches patterns previously documented in SentinelOne's PurpleHaze cluster and UNC5174 operations against VMware appliances. Outbound SSH connections bypass typical inbound firewall rules, granting persistent remote access that survives reboots and basic network segmentation.

Unpatched vCenter instances remain high-value targets because they control large virtualization estates. Organizations should audit cron jobs, inspect /websso and /sdk endpoints for anomalous traffic, and verify patch deployment beyond vendor announcements.