VMware vCenter flaw exploited by ransomware groups

Ransomware operators have begun exploiting a critical vulnerability in VMware vCenter, prompting a fresh warning from the U.S. Cybersecurity and Infrastructure Security Agency (CISA). The flaw, which allows remote code execution, was addressed in a patch released in July 2026 but remains a target for attackers on unpatched systems.

What happened

CISA issued an alert confirming that ransomware groups have joined existing attacks leveraging the vulnerability. The agency did not specify which ransomware strains or threat actors are involved, nor did it provide details on the scale of exploitation. VMware’s original advisory described the flaw as critical, though it did not disclose whether exploits were already in the wild at the time of patching.

The vulnerability affects VMware vCenter Server, a centralized management platform for virtualized environments. While CISA’s alert does not clarify whether the attacks are opportunistic or targeted, the inclusion of ransomware suggests a shift toward monetization of the exploit.

What we don’t know yet

Sources do not indicate how many organizations have been compromised, the sectors most affected, or whether the attacks have resulted in data encryption or extortion demands. The timing of the ransomware groups’ involvement—whether recent or ongoing since the patch—also remains unclear. VMware has not issued an updated statement beyond its July advisory.