Piece of news of the day

ADVANCED SECURITY EUROPA

EOOD

CISA Warns of Ransomware Gangs Exploiting Critical VMware vCenter Vulnerability

15 September 2026

The U.S.
Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about ransomware gangs exploiting a critical VMware vCenter vulnerability patched in July.
The vulnerability (CVE-2026-59310) allows unauthenticated attackers to execute arbitrary code.
A DFIR company found over 361 compromised IP addresses across 47 countries due to this vulnerability.
CISA has added the vulnerability to its Known Exploited Vulnerabilities Catalog and instructed government agencies to secure their vCenter systems.
Ransomware gangs have been actively abusing this flaw.
VMware servers are commonly targeted for ransomware attacks due to the access they provide to sensitive data.
Multiple ransomware groups have developed encryptors to target VMware virtual machines.
CISA has previously flagged other VMware vulnerabilities as exploited in attacks.
Overall, 26 VMware vulnerabilities have been exploited in the wild over the past five years, with nine of them also linked to ransomware operations.