VMware ESXi and vCenter Server are affected by several critical vulnerabilities that could lead to severe security risks. In ESXi, an authentication bypass vulnerability allows a malicious actor with sufficient Active Directory (AD) permissions to gain full access to an ESXi host by re-creating a previously deleted AD group (‘ESXi Admins’ by default). Additionally, ESXi has an out-of-bounds read vulnerability where a malicious actor with local administrative privileges on a virtual machine with an existing snapshot could trigger a denial-of-service condition on the host. Furthermore, vCenter Server is vulnerable to a denial-of-service attack, where a malicious actor with network access could create a denial-of-service condition, potentially disrupting services.