What is the CVSS score of EUVD-2026-36032?

EUVD-2026-36032 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of assisted-migration-agent are affected by EUVD-2026-36032?

kubev2v assisted-migration-agent deployments face credential compromise risk due to disabled TLS certificate verification, potentially exposing vCenter administrator access to network-based…

How to fix or mitigate EUVD-2026-36032?

24 hours: Audit all kubev2v assisted-migration-agent deployments; restrict network access to trusted internal segments only and disable internet-facing connectivity if present. 7 days: Rotate all vCenter administrator credentials used by this tool; review agent access logs and network traffic for MITM indicators (unexpected connection failures, certificate errors). 30 days: Implement network segmentation isolating migration agents from untrusted segments; determine if TLS certificate verification can be enabled via configuration or workarounds; evaluate alternative migration solutions.

assisted-migration-agent EUVD-2026-36032

| CVE-2026-53475 HIGH

Improper Certificate Validation (CWE-295)

2026-06-10 redhat

GHSA-8g5p-jxp9-457c

Authentication Bypass VMware Assisted Migration Agent

7.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

7.4 HIGH

Network vector to vCenter API, but exploitation requires an on-path MITM position, hence AC:H; no agent auth needed (PR:N/UI:N); stolen admin creds yield full C and I impact, no availability effect.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Red Hat

9.3 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Jun 16, 2026 - 14:58 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 16, 2026 - 14:58 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 16, 2026 - 14:52 vuln.today

cvss_changed

Severity Changed

Jun 16, 2026 - 14:52 NVD

CRITICAL HIGH

CVSS changed

Jun 16, 2026 - 14:52 NVD

9.3 (CRITICAL) 7.4 (HIGH)

Source Code Evidence Fetched

Jun 10, 2026 - 15:07 vuln.today

Analysis Generated

Jun 10, 2026 - 15:07 vuln.today

CVE Published

Jun 10, 2026 - 13:55 nvd

CRITICAL 9.3

DescriptionNVD

A flaw was found in assisted-migration-agent. The application hardcodes insecure Transport Layer Security (TLS) connections when communicating with vCenter. This vulnerability allows a Man-in-the-Middle (MITM) attacker to intercept and harvest vCenter administrator credentials. This can lead to unauthorized access to vCenter.

Articles & Coverage 1

News Critical Credential Theft in VMware vCenter Migration Agent - CVE-2026-53475 Jun 10, 2026

AnalysisAI

Credential interception in kubev2v assisted-migration-agent allows network-positioned attackers to harvest vCenter administrator credentials because the agent's vCenter client establishes TLS connections with certificate verification effectively disabled by default. The flaw, reported by Red Hat and tracked as EUVD-2026-36032, has no public exploit identified at time of analysis and an EPSS score of 0.01% (percentile 1%), but successful MITM exploitation yields full administrative access to the targeted vCenter.

Technical ContextAI

assisted-migration-agent is a Go-based component of the kubev2v / Migration Toolkit for Virtualization (MTV) ecosystem that helps migrate VMware vSphere workloads into KubeVirt by talking to vCenter via its HTTPS API. The defect is a textbook CWE-295 (Improper Certificate Validation): the API type VcenterCredentials had no field for a CA certificate, and the underlying models.Credentials structure was constructed with SkipTLS implicitly true, so the client trusted any presented certificate. The fix in PR #268 introduces explicit cacert (PEM bundle) and skipTls fields in the OpenAPI schema and a new CredsFromAPI helper that builds a verifying x509.CertPool when a CA is supplied; the two options are mutually exclusive. CPE coverage is cpe:2.3:a:kubev2v:assisted_migration_agent:*:*:*:*:*:*:*:*, indicating all released versions prior to the merged fix are in scope.

RemediationAI

Upstream fix available (PR/commit https://github.com/kubev2v/assisted-migration-agent/pull/268); released patched version not independently confirmed at time of analysis, so consult the Red Hat advisory https://access.redhat.com/security/cve/CVE-2026-53475 for the exact RPM/container build that ships the fix and upgrade to that release. After patching, configure vCenter credentials with the new cacert field populated with the vCenter CA bundle and leave skipTls unset or false - note that the patch preserves backwards-compatible insecure behaviour when cacert is omitted, so simply upgrading is not sufficient. Until the patch can be deployed, restrict the network path between the assisted-migration-agent pod/host and vCenter to a dedicated management segment (no transit over shared or untrusted networks), enforce egress NetworkPolicies that pin traffic to vCenter's IP, and rotate the vCenter administrator credentials used by the agent on the assumption they may have been exposed; these mitigations add operational rigidity (segmentation, credential rotation cadence) but do not require code changes.