CVE-2024-38812: VMware vCenter Server unauthenticated RCE, in CISA KEV
The short version: CVE-2024-38812 is a heap-overflow write in the DCERPC protocol implementation of VMware vCenter Server. An attacker with network access to vCenter can trigger it to achieve remote code execution on the appliance that centrally manages your ESXi hosts and virtual machines. It scores 9.8 and it's in CISA's Known Exploited Vulnerabilities catalog. Patch-and-verify, not patch-and-forget. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — in practice and on paper |
| CVSS v3.1 (NVD) | 9.8 — Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 54.14% · 98.89th percentile (2026-07-17) |
| In CISA KEV? | Yes — added 2024-11-20, remediation due 2024-12-11 |
| Known exploited? | Yes — listed in CISA KEV as known-exploited |
| Vulnerability type | CWE-787 / CWE-122 heap-based buffer overflow in DCERPC → remote code execution |
| Requires authenticated session? | No — network access to vCenter is sufficient |
| Affected | vCenter Server 7.0 (before 7.0 U3s) and 8.0 (before 8.0 U3b); VMware Cloud Foundation 4.x and 5.x |
| Fixed in | vCenter Server 7.0 U3s · 8.0 U3b (and later); apply the matching Cloud Foundation async patches |
What you need to know
vCenter Server is the control plane for a VMware environment — it manages ESXi hosts, virtual machines, storage, and networking from one place. CVE-2024-38812 is a memory-corruption bug (a heap overflow) in vCenter's implementation of the DCERPC protocol. A crafted packet overflows a heap buffer, and that corruption can be steered into code execution on the vCenter appliance.
Why this sits at the top of the queue:
- It's the management plane. Compromise of vCenter is compromise of the thing that controls your whole virtual estate — every host and VM underneath it.
- It's unauthenticated over the network. No credential is required; the attacker just needs to reach vCenter. That's why keeping vCenter off the public internet matters so much.
- It's known-exploited. CISA placed it in the KEV catalog, so this is not a theoretical risk sitting in a scanner backlog.
How serious we see it
High — the 9.8 is warranted here.
Unauthenticated, network-reachable code execution on the appliance that manages every VM you run is about as high-value as internal-and-external exposure gets. The bounded, reassuring part is that it's narrow and fixable: it affects specific vCenter builds, Broadcom has published fixes, and you can determine quickly whether you run an affected version. The catch is the usual one for a KEV-listed flaw — being patched and being clean are separate questions, so verify exposure and hunt if vCenter was reachable.
Recommendations
Straight from Broadcom's advisory and CISA:
- Patch now. Upgrade vCenter Server to 7.0 U3s / 8.0 U3b or later, and apply the corresponding Cloud Foundation patches.
- Confirm exposure and hunt. Determine whether your vCenter was network-reachable by untrusted hosts, and review for signs of exploitation.
- If compromised, respond. Rotate vCenter credentials and any secrets it holds, and investigate connected ESXi hosts.
- Harden exposure. vCenter should never be internet-facing; restrict management access to trusted networks and enforce MFA on administrative access.
- Confirm your exposure first. Verify whether you run an affected vCenter build at all.
How BreachRisk sees it
BreachRisk answers the first question — is our vCenter exposed and affected? — from the outside in. Starting from little more than your domain, it discovers internet-facing VMware management surfaces, fingerprints the vCenter product and version, and flags exposure tied to KEV-listed vulnerabilities like this one, surfaced at the top of your results because it's actively exploited. We detect and prioritize; we don't exploit the memory-corruption bug.
That continuous, attacker's-eye view is the point: when a vCenter appliance that should be internal turns up reachable from the internet, it's already mapped — so you can go straight to patch-and-verify.