CISA Adds Actively Exploited VMware vCenter Vulnerability CVE-2024-37079 to KEV Catalog

The U.S. Cybersecurity and Infrastructure Security Agency has added a critical vulnerability in VMware vCenter Server, tracked as CVE-2024-37079, to its Known Exploited Vulnerabilities catalog after confirming evidence of in-the-wild exploitation. This marks an escalation in risk for organizations that have not applied the patch released for this flaw.

CVE-2024-37079 is a heap overflow weakness in the implementation of the DCE/RPC protocol within VMware vCenter Server. Heap overflows occur when an application writes more data to a heap-allocated buffer than it was intended to hold, which can overwrite adjacent memory. In this case, improper handling of specially crafted network packets allows a remote attacker with network access to trigger a condition where arbitrary code can be executed in the context of the vCenter Server process.

Exploitation of this type of flaw generally involves sending a malformed packet to the vulnerable service that causes the heap to be corrupted in a controlled way. If the attacker successfully manipulates the program’s control flow, they can divert execution to malicious payloads. Because vCenter Server often runs with elevated privileges and has broad visibility over virtual infrastructure, gaining arbitrary code execution on this component can allow an attacker to pivot to other systems, modify virtual machine configurations, extract sensitive configuration data, or disrupt management operations.

The vulnerability had been addressed by VMware in updates released in the middle of the previous year, but the addition to CISA’s KEV catalog indicates that attackers have developed capabilities to target unpatched systems in real scenarios. Active exploitation means that defenders should treat the flaw as a priority in vulnerability management and incident response plans.

Administrators operating VMware vCenter Server should ensure that all instances are running the latest supported build that includes fixes for CVE-2024-37079. In environments where updates cannot be deployed immediately, restricting network access to the vCenter management interface and employing strict firewall rules can limit exposure. Additionally, monitoring for unusual connections to the DCE/RPC service or unexpected process behavior on vCenter hosts can help detect potential exploitation attempts.

This development underscores the importance of diligent patching and network segmentation in virtualized environments. Tools that manage and orchestrate virtual infrastructure like vCenter are high-value targets for attackers, and weaknesses in such platforms can have cascading effects throughout enterprise networks. Keeping them up to date and closely monitoring their operation remains a key defensive strategy.