CISA Issues Alert on Critical VMware vCenter RCE, Confirms Active Exploitation

The Cybersecurity and Infrastructure Security Agency (CISA) has added a critical remote code execution (RCE) vulnerability in Broadcom VMware vCenter Server to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild.

Federal agencies must patch affected systems by February 13, 2026, under Binding Operational Directive 22-01.

Vulnerability Overview

CVE-2024-37079 is an out-of-bounds write vulnerability affecting the implementation of the DCERPC (Distributed Computing Environment / Remote Procedure Call) protocol in VMware vCenter Server.

The flaw enables threat actors with network access to send specially crafted network packets to vulnerable vCenter instances, potentially achieving remote code execution without authentication.

CVE ID	Vendor	Product	Vulnerability Type
CVE-2024-37079	Broadcom	VMware vCenter Server	Out-of-bounds Write (CWE-787)

CISA’s inclusion of CVE-2024-37079 in the KEV catalog signals that attackers are actively targeting this vulnerability in real-world campaigns.

While it remains unknown whether the flaw has been leveraged in ransomware operations, the RCE nature of the vulnerability makes it a high-priority target for threat actors seeking initial access to enterprise virtualization infrastructure.

Out-of-bounds write vulnerabilities allow attackers to overwrite memory locations outside intended boundaries, potentially leading to arbitrary code execution, privilege escalation, or denial-of-service conditions.

In the context of vCenter Server the centralized management platform for VMware environments successful exploitation could grant attackers full control over virtual machines, hosts, and sensitive enterprise workloads.

CISA urges organizations to immediately apply mitigations per Broadcom’s vendor instructions.

Federal agencies and cloud service providers must follow applicable BOD 22-01 guidance.

If patches are unavailable or cannot be deployed promptly, organizations should discontinue use of affected products or implement network segmentation to restrict access to vCenter Server management interfaces.

Security teams should review access logs for suspicious DCERPC traffic, monitor for unauthorized network connections to vCenter instances, and ensure privileged accounts are protected with multi-factor authentication.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.