Unauthorized RCE in VMware VCenter

Could anyone explain to me why the jsp shell is running as system user? Shouldn't it be the user of the webserver? (something like vsphere-ui?