The U.S. Cybersecurity and Infrastructure Safety Company (CISA) on Friday added a crucial security flaw affecting Broadcom VMware vCenter Server that was patched in June 2024 to its Recognized Exploited Vulnerabilities (KEV) catalog, citing proof of energetic exploitation within the wild.
The vulnerability in query is CVE-2024-37079 (CVSS rating: 9.8), which refers to a heap overflow within the implementation of the DCE/RPC protocol that might enable a nasty actor with community entry to vCenter Server to realize distant code execution by sending a specifically crafted community packet.
It was resolved by Broadcom in June 2024, together with CVE-2024-37080, one other heap overflow within the implementation of the DCE/RPC protocol that might result in distant code execution. Chinese language cybersecurity firm QiAnXin LegendSec researchers Hao Zheng and Zibo Li have been credited with discovering and reporting the problems.
In a presentation on the Black Hat Asia security convention in April 2025, the researchers stated the 2 flaws are a part of a set of 4 vulnerabilities – three heap overflows and one privilege escalation – that have been found within the DCE/RPC service. The 2 different flaws, CVE-2024-38812 and CVE-2024-38813, have been patched by Broadcom in September 2024.
Specifically, they discovered that one of many heap overflow vulnerabilities might be chained with the privilege escalation vulnerability (CVE-2024-38813) to realize unauthorized distant root entry and in the end achieve management over ESXi.
It is at the moment not identified how CVE-2024-37079 is being exploited, if it is the work of any identified risk actor or group, or the size of such assaults. Nonetheless, Broadcom has since up to date its advisory to formally affirm in-the-wild abuse of the vulnerability.
“Broadcom has data to counsel that exploitation of CVE-2024-37079 has occurred within the wild,” the corporate stated in its replace.
In gentle of energetic exploitation, Federal Civilian Government Department (FCEB) businesses are required to replace to the newest model by February 13, 2026, for optimum safety.
