EXPOSURES › CVE-2024-37079

CVE-2024-37079

HIGH ⌖ ON CISA KEV · EXPLOITED

DETAIL

SourceCISA-KEV · kev Published2026-01-23 Referencehttps://nvd.nist.gov/vuln/detail/CVE-2024-37079 ↗

⚡ RCE ⌖ EXPLOITED IN THE WILD SHAME 72/100 rceexploited-in-wildunpatched

Broadcom's VMware vCenter Server exploited for RCE due to unpatched out-of-bounds write in DCERPC protocol

Broadcom's VMware vCenter Server had an unpatched out-of-bounds write vulnerability in the DCERPC protocol that was actively exploited, potentially leading to remote code execution.

Shame score — Active exploitation of a known vulnerability with potential for remote code execution.

▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

PLAYERS IMPLICATED

Broadcom · vendor VMware vCenter Server · product

DESCRIPTION

Broadcom VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. This could allow a malicious actor with network access to vCenter Server to send specially crafted network packets, potentially leading to remote code execution.

AFFECTED FEDRAMP PRODUCTS · 4

PRODUCT	PROVIDER	STATUS	MATCH
Clarity Broadcom	Broadcom	Authorized	vendor-exact · 0.90
General Support Systems (GSS) Broadcom	Broadcom	Authorized	vendor-exact · 0.90
Rally Broadcom	Broadcom	Authorized	vendor-exact · 0.90
Symantec Gov Cloud Security (GCS) Broadcom	Broadcom	In Process	vendor-exact · 0.90