A flaw in the Assisted Migration Agent hardcodes insecure Transport Layer Security for all connections to vCenter, disabling certificate validation. This allows an attacker to perform a Man‑in‑the‑Middle attack and capture administrator credentials that are transmitted over the network, resulting in unauthorized access to the vCenter server. The weakness is a classic TLS validation bypass (CWE‑295) and poses a severe confidentiality and integrity threat to the entire virtual infrastructure.

The vulnerability is present in all versions of the Assisted Migration Agent, as the TLS verification setting is globally disabled regardless of configuration. No specific version scope is defined, so any installation that actively connects to vCenter without custom TLS verification is affected.

The CVSS score of 9.3 classifies the flaw as critical, indicating that a successful exploit results in complete compromise of vCenter authentication. Exploitation requires only network presence between the agent and vCenter, enabling a remote attacker to intercept traffic; there is no local privilege or special conditions reported. The EPSS score is not available, but the absence of a KEV listing does not diminish the severity of the exposed traffic. An attacker can harvest credentials by simply positioning themselves in the communication path, a readily achievable attack vector in many data centre environments.