VMware vCenter Gets Ransomed Again: CVE-2026-59310 Lands on KEV

The short version//

CISA's Known Exploited Vulnerabilities (KEV) catalog just got a new entry: CVE-2026-59310, a Broadcom VMware vCenter flaw with an EPSS of 46% — meaning the model that scores "probability of exploitation in the next 30 days" based on observed exploit activity gives it nearly a coin-flip. Exploited, on the list, and climbing.

The vCenter curse//

Anyone who has run a homelab (or an enterprise) knows vCenter has a track record: it keeps getting hit, and every hit is a front-page ransomware story. The reasons are consistent:

• It's an admin portal with a crown — vCenter is the control plane for entire virtualization estates. Get in, and you can touch everything.
• It's often internet-facing (it shouldn't be, but it is) — reverse-proxy configs, port forwards, and "temporary" exposure that never got collected.
• It's a large, old Java/complex stack — the kind of codebase that accumulates subtle deserialization and auth bugs.

So when a vCenter CVE goes KEV, the assumption is not "someone might exploit this." The assumption is someone already is.

What KEV and EPSS actually mean (so you can read the news)//

Two acronyms do a lot of work in vulnerability news, and they answer different questions:

• KEV (Known Exploited Vulnerabilities) — CISA's list of vulns they've seen exploited in the wild. Being on KEV is a factual statement: there's evidence, not just theory. For US federal agencies it also carries a remediation deadline, but the real signal is the list membership itself.
• EPSS (Exploit Prediction Scoring System) — a 0–1 probability that a given CVE will be exploited in the next 30 days, trained on historical exploit data. 0.46 is high — most vulns sit well under 0.1. A high EPSS says "exploiters are actively looking at this," which, combined with KEV, says "start patching now."

Read them together: KEV = proven, EPSS = likely-to-keep-going. That combination is the "do it tonight" combination.

What you should do//

1. Patch vCenter to the version that fixes CVE-2026-59310 — and check your other Broadcom/VMware components too.
2. Stop exposing vCenter to the internet if you can. If you must, front it with a VPN or at least an IP allowlist.
3. Verify the patch actually applied — vCenter upgrades are the kind of thing that silently no-ops. Confirm the version string.
4. Assume the attacker got in before you patched — if it's been exposed, treat it as a possible compromise and look for lateral movement.