VMware fixed RCE and privilege escalation bugs in vCenter Server

CVE-2024-37079 is an out-of-bounds write (CWE-787) in the implementation of the DCERPC protocol in VMware vCenter Server, Broadcom's management platform for vSphere virtualization environments. A malicious actor with network access to a vulnerable vCenter Server can trigger the flaw by sending specially crafted network packets, corrupting memory and potentially achieving remote code execution on the server. Successful exploitation would give an attacker control of a central management component, typically a strong foothold for lateral movement across the virtualized estate, though ransomware use is currently listed as unknown. Any organization running affected vCenter Server builds is exposed, with risk highest where the management interface is reachable from untrusted networks or the internet. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-01-23, confirming exploitation in the wild; no public PoC is known, CVSS was not yet scored in the source data, and the high EPSS score (22.4%, 98th percentile) signals elevated near-term exploitation risk.

Do: Upgrade vCenter Server to a patched release per Broadcom's 2024 advisory (VMSA-2024-0012) without delay, since exploitation is confirmed in the wild and CISA BOD 22-01 requires federal agencies to apply vendor mitigations or discontinue use per the KEV deadline. Inventory your vCenter builds and compare them against the advisory's affected ranges; installations already patched for the 2024 DCERPC fixes are protected. Until patching completes, restrict network access to vCenter management interfaces (firewall allowlisting or VPN) and prioritize any internet-exposed instances.

vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution.