The U.S. Cybersecurity and Infrastructure Security Agency (CISA) picked up on an ongoing VMware flaw affecting the software’s centralized management utility. CISA added the flaw, designated as CVE-2024-37079, to its Known Exploited Vulnerabilities (KEV) catalog, warning of “significant risks to the federal enterprise.”

Affecting Broadcom's VMware vCenter Server, the exploit opens the door to remote code execution (RCE) or privilege escalation via the use of a specially made network packet. This is down to a heap-overflow vulnerability in the protocol implementation of Distributed Computing Environment/Remote Procedure Calls (DCE/RPC), a client-server framework that allows programs to call procedures on remote systems as if they were local.

Broadcom issued patches upon its discovery in 2024, with updates for users running version 7.0 and upwards of vCenter Server.

CISA has since discovered exploitation in the wild of the flaw, branding it with a Critical CVSS rating of 9.8. The body added it was unknown whether the VMware issue has been used in any ransomware attempts to date.

The VMware vCenter bug follows a recent security briefing from the National Security Agency (NSA) in conjunction with CISA, revealing a backdoor exploit for VMware vSphere. The breach allowed bad actors to grab cloned virtual machine (VM) snapshots for credential extraction and create stealth, rogue VMs via vCenter servers and the VMware ESXI hypervisor.

A separate VMware exploitation campaign was revealed this month, with attackers using a custom exploit chain to break out of a VMware guest VM and execute bad code on the ESXI hypervisor itself.

Like the NSA featured exploit, the guest-to-host exploit was linked to actors operating in a Chinese-speaking region.