Critical VMware vCenter RCE Flaw CVE-2024-37079 Under Active Attack

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical VMware vCenter Server vulnerability, tracked as CVE-2024-37079, to its Known Exploited Vulnerabilities (KEV) Catalog. This move confirms that the flaw is not just theoretical but is being actively exploited in real-world attacks.

The vulnerability affects Broadcom VMware vCenter Server, a core component used by organizations worldwide to manage virtualized infrastructure. With a CVSS score of 9.8, CVE-2024-37079 is considered extremely severe and poses a major risk to enterprises that rely on VMware environments.

CVE-2024-37079 is a heap overflow vulnerability found in the implementation of the DCE/RPC (Distributed Computing Environment / Remote Procedure Call) protocol within VMware vCenter Server.

This flaw allows an attacker with network access to the vCenter Server to send a specially crafted network packet, potentially leading to remote code execution (RCE). In simple terms, a successful exploit could allow attackers to run malicious commands on the affected server without proper authorization.

Because vCenter Server often has high-level privileges and controls multiple ESXi hosts, exploiting this vulnerability can give attackers deep access into virtualized environments.

Broadcom, which now owns VMware, patched CVE-2024-37079 in June 2024. At the same time, the company also addressed a related vulnerability, CVE-2024-37080, which is another heap overflow issue in the DCE/RPC protocol that could also lead to remote code execution.

The vulnerabilities were discovered and responsibly disclosed by Hao Zheng and Zibo Li, security researchers from Chinese cybersecurity firm QiAnXin LegendSec.

At the time of release, Broadcom did not confirm active exploitation. However, that status has now changed.

In a recent update to its security advisory, Broadcom officially acknowledged that CVE-2024-37079 has been exploited in the wild.

“Broadcom has information to suggest that exploitation of CVE-2024-37079 has occurred in the wild,” the company stated.

Based on this confirmation, CISA added the vulnerability to its KEV catalog, which is reserved for flaws that pose an immediate and serious threat to government and private-sector systems.

During Black Hat Asia 2025, the researchers shared deeper technical details about the vulnerabilities. They revealed that CVE-2024-37079 is part of a larger set of four vulnerabilities affecting the DCE/RPC service in VMware products.

These include:

• Three heap overflow vulnerabilities

• One privilege escalation vulnerability

The additional flaws are:

• CVE-2024-38812

• CVE-2024-38813

Broadcom patched these two vulnerabilities later, in September 2024.

Most concerning is the finding that one heap overflow vulnerability can be chained with CVE-2024-38813, a privilege escalation flaw. When combined, attackers could achieve unauthorized remote root access, ultimately allowing them to take control of ESXi hosts.

This attack chain significantly increases the risk, turning a single vulnerability into a full infrastructure compromise.

VMware vCenter Server often sits at the heart of enterprise IT environments. It manages:

• Virtual machines

• ESXi hosts

• Storage and networking configurations

If attackers gain access to vCenter, they may be able to:

• Deploy malware across multiple systems

• Steal sensitive enterprise data

• Shut down critical workloads

• Create persistent backdoors

• Launch ransomware attacks

Even though details about the current attacks remain limited, the confirmation of active exploitation makes this vulnerability a high priority for all organizations using VMware products.