Attackers are exploiting CVE-2026-59310, a directory-traversal flaw in VMware vCenter, to deploy Babuk-derived ransomware. Internet-exposed management interfaces remain a top ransomware entry point.
Our analysis
vCenter is a crown jewel: own it and you own every VM, snapshot and backup beneath it. That’s why crews weaponise vCenter bugs within days — it’s the fastest route to encrypting a whole estate at once. For Cyprus businesses, an internet-reachable virtualization management plane is the emergency, regardless of this specific CVE.
What you should do
- Patch vCenter and ESXi now, and never expose management interfaces to the internet.
- Segment the management plane and require MFA plus jump hosts.
- Keep offline, immutable backups ransomware can’t reach through vCenter.
- Validate your perimeter and detection with a red-team exercise.
How CyprusPentest helps: our external network penetration testing validates your perimeter, and red team operations test whether you’d detect a real intrusion.
Source: The Hacker News.