U.S. CISA Adds a Flaw in Broadcom VMware vCenter Server to Its Known Exploited Vulnerabilities Catalog

Key Takeaways

• CISA lists CVE‑2024‑37079 in KEV catalog
• Vulnerability scores 9.8, remote code execution via DCERPC
• Exploitation observed in the wild; patches released June 2024
• Federal agencies must patch by 13 Feb 2026
• Attack can combine with CVE‑2024‑38813 for ESXi root

Pulse Analysis

VMware vCenter Server is the linchpin for managing virtualized data centers, and its security directly impacts the integrity of countless workloads. The newly cataloged CVE-2024-37079 exploits a heap‑overflow in the DCERPC protocol, allowing unauthenticated attackers to execute arbitrary code with full system privileges. With a CVSS base score of 9.8, the flaw ranks among the most critical vulnerabilities discovered this year, and its inclusion in CISA’s KEV catalog signals confirmed exploitation in the wild. The advisory also notes that chaining this flaw with CVE-2024-38813 can grant root access to ESXi hosts, amplifying the attack surface.

For enterprises, the immediate concern is the lack of any viable workaround; the only mitigation is applying VMware’s June 2024 security patches. Organizations that have delayed updates face heightened risk, especially those operating legacy vCenter instances or exposing management interfaces to broader networks. CISA’s directive under BOD 22-01 mandates federal agencies to remediate by February 13, 2026, a deadline that underscores the urgency for private sector firms to follow suit. Failure to patch could result in ransomware infiltration, data exfiltration, or disruption of critical services that rely on virtual infrastructure.

The broader security landscape highlights a growing trend: attackers are targeting the management layer of cloud and on‑premises environments rather than individual workloads. As virtualization continues to underpin digital transformation, vendors and customers must adopt a proactive patch management cadence and employ network segmentation to limit exposure of management consoles. Continuous monitoring for anomalous DCERPC traffic, combined with threat‑intel feeds that flag exploitation attempts, will be vital. The CVE-2024-37079 episode serves as a reminder that even well‑established platforms can harbor severe flaws, reinforcing the need for rigorous vulnerability governance across the entire IT stack.