VMware vCenter EUVD-2026-51098

The attacker needs network access to the vCenter server, specifically to the VMware Directory Service (vmdir) endpoint; the CVSS vector AV:N/AC:L/PR:N/UI:N indicates no authentication, no user interaction, and low complexity, so no special product configuration is described as a prerequisite and default deployments are exploitable by anyone who can route to the management interface. The primary limiting factor is network reachability: environments that isolate vCenter on a restricted management network behind firewalls or jump hosts substantially reduce exposure, whereas any deployment with vCenter reachable from a broad internal segment or the internet is directly at risk. No specific non-default feature toggle, platform, or version constraint beyond running an unpatched affected build is indicated in the available data.

All available signals point to a genuine top-priority issue rather than an inflated high-CVSS finding. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describes network-based, low-complexity, unauthenticated, no-interaction exploitation with total confidentiality, integrity, and availability impact - the classic profile of a pre-auth critical. The affected component (the identity/authentication service of the central management plane) magnifies impact well beyond a single host. Tempering the urgency: no EPSS score was provided in the input, there is no public exploit identified at time of analysis, and it is not in CISA KEV, so widespread active exploitation is not confirmed. No SSVC decision data was supplied. Given vCenter's history as a high-value target that is rapidly weaponized after disclosure, the low-complexity pre-auth nature means defenders should treat exploitation as a matter of when, not if, and patch on an emergency timeline.

An attacker who can reach the vCenter appliance over the network - for example from a foothold on the same corporate or management VLAN - sends crafted requests to the VMware Directory Service that exploit the flawed authentication algorithm, bypassing credential validation. With no valid account and no user interaction they obtain authenticated access to vCenter and can then manage ESXi hosts, virtual machines, and datastores. No public proof-of-concept has been identified at time of analysis, but the low attack complexity makes reliable exploitation likely once technical details circulate.