Suspected China-Nexus Actor Exploits VMware vCenter Flaw, Deploys Babuk-Derived Ransomware

Cybersecurity researchers have attributed the exploitation of a newly patched security flaw in Broadcom VMware vCenter to a suspected China-nexus advanced persistent threat (APT). The attacks involve the exploitation of CVE-2026-59310 (CVSS score: 9.8), a severe directory-traversal vulnerability in the VMware vCenter server that could be weaponized by a malicious actor to execute arbitrary code

Report facts: Researchers describe a suspected China-nexus APT exploiting a newly patched critical directory traversal flaw (CVE-2026-59310, CVSS 9.8) in VMware vCenter Server to achieve arbitrary code execution and deploy Babuk-derived ransomware. The activity targets a widely used virtualization and data center management platform, indicating rapid weaponization of a high-severity vulnerability after disclosure and patch release. RealGround analysis: While the incident is not specifically about AI, many organizations’ AI workloads and model-serving infrastructure run on virtualized or vCenter-managed environments, so compromise at this layer can indirectly expose AI systems, data, and agents to ransomware and follow-on attacks. Hardening and continuously assessing virtualization and infrastructure supply chain components that host AI services, plus ensuring timely patching and SBOM-driven dependency visibility, materially reduces the blast radius of similar exploits against AI-related environments.