VM sprawl is the uncontrolled proliferation of virtual machines — forgotten test VMs, unpatched images, unauthorized deployments — creating an unmanaged attack surface.
Unpatched, forgotten VMs are actively exploited. Solve with: VM lifecycle management, automated decommissioning, regular audits, tagging/naming conventions, policy requiring approval for new VMs. Same principle applies to cloud resources (cloud sprawl).