Attackers are scanning VMware vCenter after critical vulnerabilities were disclosed, with DefusedCyber’s honeypots recording increased vCenter fingerprinting activity. The activity includes requests to the /sdk/ endpoint using RetrieveServiceContent and exploration of the /websso single sign-on path.
The requests do not prove compromise but show that attackers are identifying exposed systems before launching more direct attacks.
The activity follows Broadcom’s VMSA-2026-0006 security advisory, released on July 29. The advisory covers five VMware flaws across vCenter, ESX, Workstation, Fusion, Cloud Foundation, vSphere Foundation, and Telco Cloud products.
Three bugs received critical ratings. The most urgent issue for vCenter administrators is CVE-2026-59309, an authentication bypass in VMware Directory Service, vmdir. It has a CVSS score of 9.8.
Hackers Scan VMware vCenter for Exploitable Flaws
A remote attacker with network access may be able to bypass normal authentication and gain unauthorized access to the vCenter environment.
vCenter is a high-value target because it manages virtual infrastructure. An attacker who controls it may be able to change virtual-machine settings, create accounts, alter network connections, access disks, disrupt workloads, or use the platform to spread deeper into an organization.
The management plane can also hold credentials, host details, backups, and information about important business systems. This makes vCenter exposure dangerous for organizations running virtual environments.
DefusedCyber said on X that researchers also identified CVE-2026-59310, a critical directory traversal flaw in the vCenter Syslog Server that could allow network-based attackers to execute arbitrary code.
A third critical issue, CVE-2026-47876, affects the VMXNET3 virtual network adapter in ESXi. It could allow a malicious virtual-machine user to execute code on the underlying host.
Together, the flaws can give attackers several paths to reach sensitive management infrastructure. At the time the advisory was published, researchers reported no public proof-of-concept code or confirmed exploitation.
The new scanning report should therefore be treated as an early warning, not confirmation that CVE-2026-59309 is being exploited.
Scanning often begins shortly after a critical disclosure, as automated systems search for vulnerable targets. Security teams should not wait for public exploit code before acting.
Administrators should immediately identify every vCenter system and check whether it is reachable from untrusted networks. Broadcom’s fixed releases include vCenter 8.0 U3k, VMware Cloud Foundation and vSphere Foundation 9.0.2.0100, and version 9.1.0.0300.
Organizations should test and deploy the relevant updates as quickly as possible. There are no known workarounds that replace patching for these reported flaws. Defenders should also review web, reverse proxy, firewall, and vCenter logs for unusual requests to /sdk/ and /websso/.
They should investigate unexpected authentication events, new accounts, permission changes, suspicious virtual-machine activity, and unfamiliar management connections.
Restricting vCenter access to approved administrator networks, enforcing multifactor authentication, and isolating management services can reduce exposure.