by Kastro
Paper/Archive/CVE-2026-53475

CVE-2026-53475

redhat — Assisted-migration-agent: tls verification disabled on all vcenter connections

EPSS 0.3%CVSS 9.3
critical.is priorityof 100
31
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 16.9.169 × 203.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A flaw was found in assisted-migration-agent. The application hardcodes insecure Transport Layer Security (TLS) connections when communicating with vCenter. This vulnerability allows a Man-in-the-Middle (MITM) attacker to intercept and harvest vCenter administrator credentials. This can lead to unauthorized access to vCenter.

Affected

ProductAffectedFixed inSource
assisted-migration-agent< b940fec9f5032a0801e994054d30e81d64b2942ab940fec9f5032a0801e994054d30e81d64b2942aCNA

Scores by source

redhat (CNA)9.3CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refaccess.redhat.com/security/cve/CVE-2026-53475refbugzilla.redhat.com/show_bug.cgi?id=2487232refgithub.com/kubev2v/assisted-migration-agent/pull/268