Critical VMware vCenter Server Bug CVE-2024-37079 Under Active Exploitation

The vulnerability CVE-2024-37079 affects VMware vCenter Server, specifically its implementation of the DCERPC protocol, which allows remote procedure calls. This flaw, rated 9.8 on the CVSS scale, can lead to remote code execution if exploited by someone with network access. Broadcom issued a patch for this vulnerability over a year ago, yet it is now being actively exploited, prompting warnings from both Broadcom and the US Cybersecurity and Infrastructure Security Agency (CISA).

On January 19, 2026, Broadcom indicated that exploitation of CVE-2024-37079 has occurred in the wild, and CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog. Federal agencies are required to patch this flaw by February 13, 2026. The lack of immediate details regarding the scope of exploitation raises concerns about the potential impact on organizations using vCenter Server.

Security experts note that virtualization infrastructure, including VMware’s products, is a prime target for cybercriminals and state-sponsored hackers. Caitlin Condon from VulnCheck highlighted that similar vulnerabilities have been exploited by known threat actors, indicating a trend where older vulnerabilities are leveraged for new attacks.

Given that details about CVE-2024-37079 have been public for over a year, it is not surprising that attackers are exploiting this flaw. Organizations should be vigilant, as the likelihood of attackers having prior access to the victim’s environment is high, especially if vCenter Server is exposed to the public internet.

Understanding the Risks

Organizations using VMware vCenter Server must understand the critical nature of keeping software updated. The exploitation of this vulnerability underscores the importance of proactive security measures and timely application of patches. With the potential for remote code execution, the risks include unauthorized access to sensitive systems and data.

Monitoring for unusual activity and ensuring that vCenter Server is not exposed to the public internet are essential steps in mitigating risks associated with this vulnerability. Organizations should also review their incident response plans to prepare for potential exploitation scenarios.

• CVE-2024-37079: A critical vulnerability in VMware vCenter Server that allows for remote code execution.
• DCERPC: The protocol involved in the vulnerability, enabling remote procedure calls across networks.
• Broadcom: The vendor that issued a patch for the vulnerability over a year ago.
• CISA: The US agency that added this vulnerability to its Known Exploited Vulnerabilities Catalog.
• CVE-2023-34048: A previous vulnerability in vCenter Server that was exploited by known threat actors.