The vCenter Bug That Let Ransomware Skip the Endpoints

Broadcom patched a directory traversal flaw in VMware vCenter Server on July 29, 2026, scoring it 9.8. By the time CISA confirmed on September 15, 2026 that ransomware gangs had joined an active campaign against CVE-2026-59310, a suspected China-nexus actor had already compromised 361 victim IP addresses across 47 countries and dropped Babuk-derived ransomware directly onto ESXi hosts.

The technical reason this matters is structural. vCenter sits at the control plane of enterprise virtualization. Compromise one instance and an attacker can potentially reach every ESXi host it manages, encrypting entire virtual machine fleets in a single operation rather than chasing individual endpoints. The patch-to-deployment gap is where the damage is happening.

A separate incident shows what that looks like at full scale. A control-plane ransomware operation against IDCF Cloud, a SoftBank subsidiary, incapacitated four availability zones in East Japan Region 1, impacted 495 enterprise and municipal tenants, encrypted 239 virtualization hosts, sealed 16,600 virtual disk volumes, and purged 554,153 internal snapshots. The evidence does not establish that this incident used CVE-2026-59310, Babuk, or the same actors. It stands as an independent demonstration of the same attack pattern.

The trend line is not ambiguous. Dragos tracked 119 ransomware groups targeting industrial organizations in 2025, up 49 percent from 80 in 2024, with 3,300 industrial organizations hit versus 1,693 the prior year. Remote-access portals and virtualization services were the most common compromise vector.

Claims that this amounts to a confirmed US, UK, or EU sovereign-cloud collapse outrun the evidence. The corroborated record shows a 47-country vCenter campaign and a Japan-based cloud incident, not a verified multi-region outage. Europe's sovereign cloud initiatives do carry a separate structural exposure: most qualified operators still rely on Intel or AMD processors whose management engines run below the operating system, and under RISAA 2024 hardware manufacturers count as electronic communications service providers subject to secret government orders. That is a supply-chain concern, not proof of this campaign's reach.

• Patch vCenter to 9.1.0.0300, 9.0.2.0100, or 8.0 Update 3k, and verify deployment rather than assuming it. - Treat vCenter and other virtualization management interfaces as tier-zero assets: isolate them from general networks, restrict management access, and enforce MFA. - Hunt for directory traversal attempts against vCenter and for unusual ESXi host activity, including snapshot deletion and bulk disk operations. - Audit snapshot and backup integrity. The IDCF incident purged 554,153 snapshots, which removes recovery options before encryption. - Inventory internet-exposed remote-access portals and virtualization services, the leading compromise vector in the Dragos data. - Track CISA KEV deadlines for CVE-2026-59310 and confirm remediation across all managed instances.