VMware vCenter Server File Upload Vulnerability (Exploited by UNC3886)

VMware vCenter Server contains a critical file upload vulnerability that allows an authenticated attacker to upload arbitrary files to the system. This vulnerability has been actively exploited in the wild by the threat actor UNC3886 (also tracked as VIRTUALPITA) to deploy backdoors and maintain persistent access to compromised environments.

The vulnerability exists in the vCenter Server update mechanism and allows an attacker with administrative access to upload malicious files that can be executed with elevated privileges. UNC3886 has exploited this vulnerability as part of a sophisticated attack chain targeting virtualization infrastructure.

Mandiant has reported that UNC3886 has used this vulnerability in conjunction with other VMware product vulnerabilities to establish persistence, deploy backdoors, and move laterally within compromised environments.