VMware vCenter contains an authentication bypass flaw in the VMware Directory Service. An attacker who can reach the vCenter management interface over the network can exploit this weakness to log in as any user without providing credentials. This CWE-303 weakness undermines fundamental authorization checks, giving the attacker full control over the vCenter console and all virtualized workloads it manages. The result is unrestricted ability to create, modify, and delete virtual machines, expose or exfiltrate data, and potentially pivot to other hosts, thus threatening confidentiality, integrity, and availability across the infrastructure.

Affected vendors include VMware; products impacted are Cloud Foundation, Telco Cloud Infrastructure, Telco Cloud Platform, vCenter, and vSphere Foundation. No specific version numbers are listed in the advisory, so any installation of these products that has not yet applied the vendor's fix remains vulnerable.

The CVSS score of 9.8 demonstrates a critical level of severity. The EPSS score is reported as less than 1%, indicating a low probability of exploitation in the wild, yet the lack of KEV listing does not mitigate the potential damage. An attacker only needs network access to the vCenter management interface; no special privileges are required prior to exploitation. Once the authentication bypass is achieved, the attacker can perform any operation supported by vCenter, effectively gaining comprehensive control over the virtual environment. Although the exploitation path is straightforward, the high impact warrants immediate action.