cyfenced.com →

[ CVE-2024-37079 · Published 18 Jun 2024 ]

Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability

Exploited · CISA KEV CVSS 9.8 EPSS 22%Fix available

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2026-01-23
  • EPSS: 22% chance of exploitation in the next 30 days (higher than 98% of CVEs)
  • Critical severity: CVSS 9.8

[ Description ]Official description

vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution.

CISA: Broadcom VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. This could allow a malicious actor with network access to vCenter Server to send specially crafted network packets, potentially leading to remote code execution.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 13 Feb 2026): Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

[ References ]References