Today’s Field Note

Two critical unauthenticated RCEs are being worked in the wild simultaneously, and neither is waiting on your change window. A suspected China-nexus actor is chaining CVE-2026-59310 (CVSS 9.8, directory traversal in Broadcom VMware vCenter) into arbitrary code execution and deploying Babuk-derived ransomware, which means the hypervisor management plane is the ransom target, not just a foothold. Separately, SAP Commerce Cloud CVE-2026-58231 went from disclosure to active exploitation in three days, a reminder that “patch soon” is now measured in hours. vCenter is the single point of failure most orgs pretend it isn’t. If it’s reachable and unpatched, assume interest.

Today’s Action

  • Patch VMware vCenter for CVE-2026-59310 now; if you can’t, pull vCenter off any internet-facing or broadly-routable segment immediately.
  • Apply the SAP vendor fix for CVE-2026-58231 on Commerce Cloud today, or take exposed storefront components offline until you can.
  • Hunt vCenter logs for directory-traversal patterns and unexpected file writes; check for new local accounts, rogue scheduled tasks, and Babuk-style encryptor artifacts.
  • Verify your VM and datastore backups are offline, immutable, and actually restorable, since the ransomware is aimed at the management layer that controls them.
  • Restrict vCenter and SAP admin access to jump hosts with MFA, and rotate any credentials that touched those systems recently.

Resources

Verified links for the CVEs mentioned above: official advisories, and a live search for public detection rules if any exist yet.

The management plane was always the crown jewel. The attackers just read the docs first.

More: Issues · Field Notes · RTFM

Daily field notes, weekly Issues. Follow @itsalreadywhen or subscribe via RSS.