CISA Warns of Actively Exploited Critical VMware vCenter RCE Vulnerability

The Cybersecurity and Infrastructure Security Agency (CISA) has added a critical remote code execution (RCE) vulnerability in Broadcom VMware vCenter Server to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild.

Federal agencies must patch affected systems by February 13, 2026, under Binding Operational Directive 22-01.

Vulnerability Overview

CVE-2024-37079 is an out-of-bounds write vulnerability affecting the DCERPC (Distributed Computing Environment / Remote Procedure Call) protocol implementation in VMware vCenter Server.

The flaw enables threat actors with network access to send specially crafted network packets to vulnerable vCenter instances, potentially achieving remote code execution without authentication.

CISA’s inclusion of CVE-2024-37079 in the KEV catalog signals that attackers are actively targeting this vulnerability in real-world campaigns.

While it remains unknown whether the flaw has been leveraged in ransomware operations, the RCE nature of the vulnerability makes it a high-priority target for threat actors seeking initial access to enterprise virtualization infrastructure.

Out-of-bounds write vulnerabilities allow attackers to overwrite memory locations outside intended boundaries, potentially leading to arbitrary code execution, privilege escalation, or denial-of-service conditions.

In the context of vCenter Server, the centralized management platform for the VMware environment,s successful exploitation could grant attackers full control over virtual machines, hosts, and sensitive enterprise workloads.

CISA urges organizations to immediately apply mitigations per Broadcom’s vendor instructions. Federal agencies and cloud service providers must follow applicable BOD 22-01 guidance.

If patches are unavailable or cannot be deployed promptly, organizations should discontinue use of affected products or implement network segmentation to restrict access to vCenter Server management interfaces.

Security teams should prioritize the following actions:

• Review access logs for suspicious DCERPC traffic
• Monitor for unauthorized network connections to vCenter instances
• Ensure privileged accounts are protected with multi-factor authentication
• Evaluate network segmentation strategies to isolate the vCenter infrastructure
• Maintain an updated inventory of all vCenter deployments within the environment

The active exploitation of CVE-2024-37079 underscores the critical importance of timely patching and vulnerability management in virtualized environments.

With the February 13 deadline approaching for federal agencies, organizations should treat this vulnerability as a priority and allocate resources to remediation efforts immediately.

The potential for full infrastructure compromise makes this vulnerability particularly dangerous for enterprises relying on VMware virtualization technologies.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.