#vcenter

Analysis · May 20, 2026 · Colten Anderson

The virtualization control plane keeps getting RCE'd, and ESXiArgs showed why that matters

vCenter and ESXi run your entire virtual estate. A run of pre-auth RCEs in vCenter (CVE-2021-21972, 21975, 21985, 22005) and the ESXi OpenSLP bugs (CVE-2019-5544, CVE-2020-3992) that fed the ESXiArgs ransomware wave show why the management layer is a crown-jewel target.