CISA Adds Actively Exploited VMware vCenter Flaw CVE-2024

CVE-2024-37079 is an out-of-bounds write (CWE-787) in the implementation of the DCERPC protocol in VMware vCenter Server, Broadcom's management platform for vSphere virtualization environments. A malicious actor with network access to a vulnerable vCenter Server can trigger the flaw by sending specially crafted network packets, corrupting memory and potentially achieving remote code execution on the server. Successful exploitation would give an attacker control of a central management component, typically a strong foothold for lateral movement across the virtualized estate, though ransomware use is currently listed as unknown. Any organization running affected vCenter Server builds is exposed, with risk highest where the management interface is reachable from untrusted networks or the internet. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-01-23, confirming exploitation in the wild; no public PoC is known, CVSS was not yet scored in the source data, and the high EPSS score (22.4%, 98th percentile) signals elevated near-term exploitation risk.

Do: Upgrade vCenter Server to a patched release per Broadcom's 2024 advisory (VMSA-2024-0012) without delay, since exploitation is confirmed in the wild and CISA BOD 22-01 requires federal agencies to apply vendor mitigations or discontinue use per the KEV deadline. Inventory your vCenter builds and compare them against the advisory's affected ranges; installations already patched for the 2024 DCERPC fixes are protected. Until patching completes, restrict network access to vCenter management interfaces (firewall allowlisting or VPN) and prioritize any internet-exposed instances.

vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution.

VMware vCenter Server contains a heap-based buffer overflow (CWE-122/CWE-787) in its implementation of the DCERPC protocol. A remote attacker with network access to vCenter Server can trigger the flaw by sending a specially crafted network packet; no credentials, privileges, or user interaction are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N). Successful exploitation can lead to remote code execution with high impact on confidentiality, integrity, and availability of the vCenter host. Affected products are VMware vCenter Server and VMware Cloud Foundation deployments, with the exact vulnerable version ranges specified in the Broadcom/VMware advisory. The flaw is confirmed to be exploited in the wild: CISA added it to the KEV catalog on 2024-11-20, EPSS estimates a 54.6% probability of exploitation within 30 days (99th percentile), and related reporting describes PRC hackers using the BRICKSTORM backdoor in campaigns involving actively exploited VMware vCenter flaws; no public proof-of-concept is known.

Do: Apply the patched vCenter Server / VMware Cloud Foundation releases issued by Broadcom per the vendor advisory, and because reporting indicates the fix was re-issued, verify the latest patched build is actually installed rather than an earlier, possibly incomplete one. Prioritize patching internet-facing vCenter instances and restrict network access to the vCenter management interface in the interim. Per the CISA KEV required action, apply vendor mitigations or discontinue use if mitigations are unavailable, and hunt for signs of post-exploitation (e.g., BRICKSTORM activity) given confirmed in-the-wild exploitation.