Today, I observed a rise in scans for the VMWare Hybrid Cloud Extension (HCX) “sessions” endpoint. Such endpoints are occasionally linked to exploitation attempts targeting diverse VMWare weaknesses to ascertain whether the system is operating the extensions or to collect further details that could facilitate exploitation.