A patched critical remote code execution vulnerability tracked as CVE-2021-22005 is being actively scanned for by attackers, and it impacts internet-connected VMware vCenter Server versions 6.7 and 7.0 that still maintain the default configurations. The passive scans began just hours after VMware released the patched update, and the attackers are targeting systems that could not be patched by users due to either necessity or negligence. Potentially thousands of vCenter servers are vulnerable to these scans, and VMware has warned their vCenter customers that they should expect exploitation attempts on their infrastructure, and that it’s safest to assume that attackers have already breached their networks somewhere. “This vulnerability can be used by anyone who can reach vCenter Server over the network to gain access, regardless of the configuration settings of vCenter Server,” said Bob Plankers, Technical Marketing Architect at VMware. Although proof-of-concept exploit code isn’t publicly available, vCenter administrators are urged to update to the patched versions immediately, and/or modify the default configurations. Even so, at this time, users should assume that their networks have already been compromised and attackers likely have taken control of something behind a corporate firewall. The Ankura CTAPT will monitor the fallout from this mass-compromise and provide updates to our readers as more information becomes publicly available.