CISA Flags Actively Exploited VMware vCenter Server RCE (CVE-2024-37079)

CISA added CVE-2024-37079, a critical VMware vCenter Server vulnerability, to its Known Exploited Vulnerabilities (KEV) Catalog after Broadcom indicated it has evidence of in-the-wild exploitation. The flaw is a 9.8 CVSS out-of-bounds write/heap-overflow issue in vCenter Server’s DCERPC implementation; an attacker with network access can send specially crafted packets that may result in remote code execution (RCE). CISA’s KEV entry does not attribute exploitation to a specific threat actor and lists ransomware use as unknown, but the KEV addition triggers mandatory remediation timelines for US federal agencies.

Reporting also noted CISA added multiple other enterprise software issues to KEV in a short span (including vulnerabilities affecting Versa Concerto and Zimbra, plus developer tools), but the vCenter Server item drew specific attention because it was patched by Broadcom in 2024 and is still being exploited. Broadcom has not publicly provided details on the scope, victims, or exploitation chain beyond acknowledging observed exploitation, reinforcing the need for organizations running vCenter Server to validate exposure and ensure the relevant updates are deployed.