It's safe to say that anybody who exposes VCenter directly to the web is practicing poor security. I cannot imagine any scenario where this would be required.

It's safe to say that anybody who exposes VCenter directly to the web is practicing poor security. I cannot imagine any scenario where this would be required. I manage a few VxRail/vSphere clusters and everything is behind firewalls and VPNs. That said, I understand that this vulnerability basically gives root to anyone with VPN access. In our case, pretty much anyone who has VPN access to the cluster already has root on it anyway.