CISA hat am 23.01.2026 bestätigt, dass diese Schwachstelle in echten Angriffen genutzt wird. Frist für US-Bundesbehörden: 13.02.2026.
Erforderliche Maßnahme: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24453 ; https://nvd.nist.gov/vuln/detail/CVE-2024-37079
vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution.
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| — | VMware Cloud Foundation | 5.x, 4.x | |
| — | VMware vCenter Server | 8.0 – < 8.0 U2d, 8.0 – < 8.0 U1e, 7.0 – < 7.0 U3r | |
| vmware | cloud foundation | 4.0 – < 5.2 | |
| vmware | vcenter server | 8.0 |
cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:* ≥ 4.0 < 5.2cpe:2.3:a:vmware:vcenter_server:8.0:-:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:8.0:a:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:8.0:b:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:8.0:c:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:8.0:update1:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:8.0:update1a:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:8.0:update1b:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:8.0:update1c:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:8.0:update1d:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:8.0:update2:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:8.0:update2a:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:8.0:update2b:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:8.0:update2c:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:7.0:-:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:7.0:a:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:7.0:b:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:7.0:c:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:7.0:d:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:7.0:update1:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:7.0:update1a:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:7.0:update1c:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:7.0:update1d:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:7.0:update2:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:7.0:update2a:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:7.0:update2b:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:7.0:update2c:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:7.0:update2d:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:7.0:update3:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:7.0:update3a:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:7.0:update3c:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:7.0:update3d:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:7.0:update3e:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:7.0:update3f:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:7.0:update3g:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:7.0:update3h:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:7.0:update3i:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:7.0:update3j:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:7.0:update3k:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:7.0:update3l:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:7.0:update3m:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:7.0:update3n:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:7.0:update3o:*:*:*:*:*:*cpe:2.3:a:vmware:vcenter_server:7.0:update3p:*:*:*:*:*:*Unser kostenloser Open-Source-Honeypot wartet auf Ports, die Ihr Server nicht nutzt, und meldet verbindende Scanner und Angreifer an eine gemeinsame Blockliste.