EUVD-2026-51098
GHSA-fcv2-9hgc-5mgq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Pre-auth, network-reachable authentication bypass with low complexity and no interaction yields full admin-equivalent access, so PR:N and C/I/A all High.
Primary rating from Vendor (vmware).
CVSS VectorVendor: vmware
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized access to the system.
Articles & Coverage 2
AnalysisAI
Authentication bypass in VMware vCenter's Directory Service (vmdir) lets an attacker with network reachability to vCenter defeat the authentication algorithm and obtain unauthorized access without valid credentials. Because vCenter is the central management plane for vSphere environments, this exposes control over the entire virtual estate; the flaw is remotely exploitable with no privileges or user interaction (CVSS 9.8). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker needs network access to the vCenter server, specifically to the VMware Directory Service (vmdir) endpoint; the CVSS vector AV:N/AC:L/PR:N/UI:N indicates no authentication, no user interaction, and low complexity, so no special product configuration is described as a prerequisite and default deployments are exploitable by anyone who can route to the management interface. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All available signals point to a genuine top-priority issue rather than an inflated high-CVSS finding. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach the vCenter appliance over the network - for example from a foothold on the same corporate or management VLAN - sends crafted requests to the VMware Directory Service that exploit the flawed authentication algorithm, bypassing credential validation. With no valid account and no user interaction they obtain authenticated access to vCenter and can then manage ESXi hosts, virtual machines, and datastores. … |
| Remediation | Apply the fixed vCenter builds published by Broadcom/VMware in the security advisory referenced at https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017; because the exact patched version is not enumerated in the provided data, obtain the precise fixed build for your specific deployment (standalone vCenter, Cloud Foundation, vSphere Foundation, or Telco Cloud) from that advisory - patch available per vendor advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify and document all vCenter instances across your environment and assess their network reachability; implement emergency network access controls restricting vCenter connectivity to designated administrative networks or jump hosts only; brief executive leadership on the critical severity and unavailability of a vendor patch. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Cloud Foundation
View allVMware ESXi and Workstation contain a TOCTOU race condition leading to out-of-bounds write, allowing local administrator
VMware ESXi contains an arbitrary write vulnerability that allows privileged VMX process users to trigger kernel writes,
VMware Aria Operations contains a command injection vulnerability (CVE-2026-22719, CVSS 8.1) that allows unauthenticated
VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability via HGFS out-of-bounds read, allowi
VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side templa
The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. Rated critical severity (CV
The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual
The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. Rated critical sev
Remote code execution in VMware vCenter Server (and bundled distributions including Cloud Foundation, vSphere Foundation
The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo. Rated h
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due t
The vCenter Server contains multiple local privilege escalation vulnerabilities due to improper permissions of files and
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today