A network-reachable flaw in vCenter’s Syslog service lets an attacker write files outside its intended directory, leading to arbitrary code execution on the server that controls your virtual infrastructure.