VMWare’s vCenter Server is vulnerable to a remote code execution (RCE) vulnerability. That means, an attacker would be able to execute code on any machine with that software reachable from the internet. Executing arbitrary code would also allow malware to replicate, AKA worm. The vulnerability is tracked as CVE-2021-21985.
Code execution flaw in vCenter is exploited to install web shell on unpatched machines.
From the article
Source: This is not a drill: VMware vuln with 9.8 severity rating is under attack | Ars Technica