A China-nexus threat actor turned a directory-traversal bug in VMware vCenter into a ransomware delivery mechanism this week. CVE-2026-59310 is a CVSS 9.8 unauthenticated RCE — and attackers are already using it to deploy Babuk. Meanwhile, Clop’s supply-chain campaign reached GE and Philips, SAP Commerce Cloud got exploited three days after disclosure, and France lost 678,000 tax records. The common thread: management-plane exposure, unpatched internet-facing assets, and attacker timelines that outrun monthly patch cycles.

In the News

China-Nexus APT Chains vCenter Zero-Day Into Babuk Ransomware

CVE-2026-59310 is a directory-traversal vulnerability in Broadcom VMware vCenter Server that allows unauthenticated remote code execution. The flaw carries a CVSS score of 9.8. A suspected China-nexus advanced persistent threat group is actively exploiting it to gain access to hypervisor management planes and deploy a variant of the Babuk ransomware.

The attack chain is direct: directory traversal to arbitrary file write, then code execution, then ransomware deployment — all without authentication. The target is the management plane itself, which means a single compromised vCenter instance can give an attacker control over every virtual machine in the environment. This is not a theoretical risk. Babuk variants are landing on production infrastructure now.

Broadcom has released a patch. Any organization running vCenter should verify — not assume — that the patch has been applied. Beyond patching, the immediate compensating control is network segmentation: vCenter management interfaces should never be reachable from general-purpose network segments or the internet. If your vCenter management plane is on the same VLAN as your production workloads, the blast radius of this vulnerability extends to your entire virtualized environment.

What defenders should do: Apply the Broadcom patch immediately. Verify vCenter management interfaces are segmented to dedicated admin-only subnets. Deploy EDR on hypervisor management hosts. Audit vCenter access logs for directory-traversal indicators — specifically requests containing ../ sequences targeting vCenter API endpoints.

Clop Claims GE and Philips Breaches — Both Confirm Investigations

The Clop ransomware group has claimed data theft from both GE and Philips, two Fortune 500 manufacturers with significant healthcare and industrial technology portfolios. Both companies have confirmed active investigations. The specific access vector has not been publicly disclosed.

Clop’s operational pattern over the past 18 months has been consistent: identify a zero-day or recently disclosed vulnerability in a managed file transfer (MFT) platform, exploit it at scale across hundreds of organizations, then exfiltrate data and post victims to their leak site. The MOVEit campaign established this playbook, and Clop has refined it across multiple MFT platforms since.

The downstream risk extends beyond GE and Philips themselves. Organizations that receive data from, integrate with, or operate within the supply chains of these two manufacturers should assess whether their data was included in the exfiltration scope. This is a supply-chain risk management conversation, not just an incident response conversation.

What defenders should do: Audit your organization’s data-sharing relationships with GE and Philips. Review MFT platform patch status across your environment. Implement network-level monitoring for anomalous bulk file transfers that match Clop’s exfiltration patterns.

France’s Tax Authority Breached — 678,000 Citizen Records Stolen

France’s General Directorate of Public Finances (DGFiP) has confirmed a breach exposing 678,000 citizen records. The access vector has not been disclosed. The incident is under active investigation.

The scale matters less than the context: a national tax authority with regulatory compliance obligations, dedicated security teams, and government-grade infrastructure was still breached. The DGFiP handles some of the most sensitive citizen data a government holds — tax filings, income records, identification numbers. Whatever control failed, the outcome is 678,000 records in attacker hands.

For practitioners in regulated verticals — healthcare, financial services, government — this is a concrete datapoint for justifying zero-trust segmentation and continuous monitoring investments. The argument is simple: if a G7 tax authority with compliance mandates and dedicated security staff cannot prevent unauthorized data access, the assumption that compliance equals security does not hold.

What defenders should do: Use this incident to validate internal segmentation of sensitive data stores. Ensure identity governance controls limit access to citizen/customer PII to the minimum required roles. Deploy continuous monitoring on data repositories that hold regulated records.

SAP Commerce Cloud RCE Exploited Three Days After Disclosure

CVE-2026-58231 is a CVSS 9.8 remote code execution vulnerability in SAP Commerce Cloud. It was exploited in the wild three days after public disclosure — a timeline that makes monthly or even biweekly patch cycles dangerously inadequate.

Three days from advisory to exploitation is not an outlier. It is the operational reality for internet-facing enterprise applications in 2026. Attackers monitor the same advisories defenders do, and weaponization timelines have compressed to the point where the window between “patch available” and “exploit in the wild” is measured in hours, not weeks. Any SAP Commerce Cloud instance that was not patched within 72 hours of disclosure was a live target.

What defenders should do: Verify SAP Commerce Cloud instances are patched. Audit application logs for post-exploitation artifacts. Shift vulnerability management workflows from CVSS-score prioritization to active-exploitation-status prioritization — CISA KEV additions and vendor-confirmed exploitation should trigger immediate patching, not a ticket in the next sprint.

Defender Action Items

  • CVE-2026-59310 (vCenter): Patch immediately. Segment vCenter management interfaces to admin-only subnets. Deploy EDR on hypervisor hosts. Audit access logs for directory-traversal indicators.
  • CVE-2026-58231 (SAP Commerce Cloud): Patch immediately. Audit for post-exploitation artifacts. Move to exploitation-status-based patch prioritization.
  • CVE-2026-69414 (Microsoft Defender): Monitor Microsoft’s advisory — patch in development. Assess compensating endpoint controls if Defender is primary antimalware. Consider layering a secondary detection capability until the patch ships.
  • Clop / supply-chain exposure: Audit data-sharing relationships with GE and Philips. Review MFT platform patch status across your environment.
  • DGFiP breach: Use as a catalyst for validating internal data-store segmentation and identity governance controls on PII repositories.

Detection Queries

The following Splunk SPL query detects directory-traversal attempts against VMware vCenter web endpoints — the primary exploitation vector for CVE-2026-59310. Tune the index and sourcetype to match your environment’s web proxy or vCenter access logs.

index=web OR index=vcenter sourcetype=vmware:vcenter:web OR sourcetype=proxy
| regex _raw="\.\.(/|%2[fF])"
| search uri_path="*vpxd*" OR uri_path="*vsphere-client*" OR uri_path="*sdk*"
| stats count by src_ip, dest_ip, uri_path, status
| where count > 5
| sort -count

This query looks for repeated requests containing ../ or URL-encoded equivalents targeting vCenter-specific URI paths. A count threshold of 5 reduces false positives from legitimate path references while catching automated exploitation attempts. Expect low false-positive rates in environments where vCenter management interfaces are properly segmented — if you see hits from non-admin subnets, investigate immediately.

References

Subscribe to the it-learn Brief

Get the daily cybersecurity brief in your inbox every weekday morning — news, SE angles, and detection queries.