[FD] [Security Advisory] Takeover of unconfigured VMware VCF Operations

[k8x9p2m7 via Fulldisclosure <fulldisclosure@xxxxxxxxxxxx>]

Sharing a security advisory that may be of interest to the Full Disclosure 
community.

Title: Unauthenticated First-Boot Provisioning Permits Administrative Takeover

Affected product: VMware Cloud Foundation Operations

Advisory: https://research.kecyber.com/advisories/2026/kecyber-sa-2026-001/

The advisory describes an unauthenticated first-boot provisioning issue that 
could allow an attacker with network access to claim administrative ownership 
of a newly deployed appliance before legitimate initialization is completed.

The vendor reportedly considers this behavior intended functionality rather 
than a security vulnerability and has declined to assign a CVE.

The publication includes technical details, affected endpoints, reproduction 
information, the vendor's response, and recommended mitigations.
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/