CVE-2026-53475: Assisted-migration-agent: tls verification disabled on all vcenter connections

Synopsis

This is a TLS verification bypass in assisted-migration-agent, a tool that communicates with VMware vCenter during workload migrations. The flaw is reachable over an adjacent network (LAN, VPN, or similar shared segment) with no authentication required, because the agent hardcodes insecure TLS settings and never validates the server certificate. A man-in-the-middle attacker positioned on that network segment can intercept the connection, harvest vCenter administrator credentials, and gain unauthorized access to the vCenter environment. A patched-image rebuild at the fix commit is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be positioned on an adjacent network such as a LAN, VPN segment, or shared cloud subnet where they can intercept traffic between the agent and vCenter.

• AuthenticationNot required

  No credentials or prior account access are needed; the agent accepts any certificate presented during the TLS handshake.

• Victim interactionNot required

  No user action is required; exploitation occurs passively whenever the agent initiates a connection to vCenter.

• Attack complexityDetail

  Exploit reliability is high with no race conditions or special environmental prerequisites beyond adjacent-network positioning.

Blast Radius

• Attacker reads vCenter administrator credentials in transit, including usernames and passwords or session tokens passed during the TLS handshake or application-layer authentication.
• Attacker uses harvested credentials to log in to vCenter directly, gaining full administrative control over the virtualization infrastructure.
• Attacker can enumerate, modify, or delete virtual machines, datastores, and network configurations within the compromised vCenter environment.