VMware issued a patch for a critical bug that could allow an attacker to steal companies’ sensitive data.

The virtualization giant disclosed and patched the sensitive information vulnerability late last week and rated it 10 out of 10 on the CVSSv3 vulnerability severity scale. This means an exploitation “results in the complete compromise of confidentiality, integrity, and availability of user data and/or processing resources without user interaction,” according to VMware.

“Exploitation could be leveraged to propagate an internet worm or execute arbitrary code between virtual machines and/or the host operating system.”

The bug, found in the VMware Directory Service, could allow a hacker to “extract highly sensitive information which could be used to compromise vCenter Server or other services which are dependent upon vmdir [VMware Directory Service] for authentication,” according to the security advisory.

VMware’s vCenter Server provides centralized management of enterprises’ vSphere virtual infrastructure from a single console. “With vCenter Server, virtual environments are easier to manage: a single administrator can manage hundreds of workloads, more than doubling typical productivity when managing physical infrastructure,” the company says. But this also makes the bug more dangerous because of the sheer number of workloads that it could expose to malicious actors.

While there are no workarounds to fix the bug, VMware did issue patches for vCenter Server deployments running on virtual appliances and Windows. It also published a document that outlines steps to determine whether or not a particular deployment is affected by the bug.