CVE-2019-5544

VMware ESXi and Horizon DaaS products contained a heap-based buffer overflow vulnerability actively exploited by attackers to achieve remote code execution (RCE).

A buffer overflow in VMware's ESXi and Horizon DaaS products allowed attackers with network access to execute arbitrary code, demonstrating a critical failure in secure coding practices. DIB organizations using these products face significant exposure to ransomware and other malicious attacks, potentially impacting CMMC compliance and requiring immediate mitigation. Patching and hardening network configurations are essential.

Shame score — VMware's history of critical RCE vulnerabilities in core products, coupled with active exploitation by ransomware, highlights a pattern of negligence and inadequate security controls.