Critical VMware vCenter Flaw Now Exploited by Ransomware Groups

Affected Environment
VMware vCenter Server deployments running the vulnerable Syslog Server component patched 29 July 2026.

Threat Overview
A critical remote code execution flaw is under active exploitation by ransomware groups targeting vCenter.

Exposure Timeline
Patched 29 July 2026; CISA's KEV catalog now confirms ransomware groups are actively exploiting it.

Attack Surface
The vCenter Syslog Server, reachable by unauthenticated attackers with network access to the server.

Technical Root Cause
A critical vulnerability in the Syslog Server component enables unauthenticated remote code execution.

Exploitation Pathway
Unauthenticated attacker with network access executes arbitrary code, then deploys a reverse SSH backdoor.