When a creature attacks, the default rule (CR 508.1f) requires it to become tapped as part of the attack declaration. However, vigilance is a static ability that modifies this rule: a creature with vigilance simply does not tap when declared as an attacker (CR 702.20b).
This exception applies regardless of why the creature is attacking. Whether a creature attacks because its controller chose to attack with it, or because an effect like Fumble forces it to attack, the game still follows the same attacking procedure — and vigilance still prevents the tapping that would otherwise occur during that procedure.
Fumble (and similar 'goad' or forced-attack effects) compel a creature to be declared as an attacker, but they don't remove or override the creature's abilities. Vigilance is still present on the creature during the declare attackers step, so CR 702.20b still applies.
Example: Your opponent controls a 3/3 Knight with vigilance. An effect forces it to attack you this turn. During the declare attackers step, the Knight is declared as an attacker but does not tap, because vigilance prevents tapping upon attacking (CR 702.20b). It can still block next turn.
Note that if the creature somehow lost vigilance before or during the declare attackers step, it would then tap normally per CR 508.1f. But as long as vigilance is present when attacking is declared, no tapping occurs.
Unofficial fan resource — not affiliated with or endorsed by Wizards of the Coast. Answers are AI-generated estimates grounded in the Comprehensive Rules and are not a substitute for an official judge. Verify anything match-critical.