Patch analysis demonstrates two independent pre-authentication routes into VMware vCenter.

One route uses a crafted SRP value to authenticate to vmdir as an existing identity without its password. The other uses traversal in syslog fields for arbitrary file write; researchers reached code execution but withheld the final sink. Broadcom has fixed builds, while pre-fix image acceptance and revocation completeness remain unknown.