---
title: "vCenter CVE-2023-34048: DCERPC RCE Exploited Since 2021"
url: https://erroneo.us/security/briefs/vcenter-cve-2023-34048-dcerpc-rce/
description: "Unauthenticated DCERPC out-of-bounds write in vCenter Server, used by espionage group UNC3886 from late 2021. Fixed in 8.0U2, 8.0U1d, 7.0U3o. Confirm and hunt."
type: security-brief
section: "Security Digest"
date_published: 2023-10-25
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2023-34048"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# vCenter CVE-2023-34048: DCERPC RCE Exploited Since 2021

**Verdict: Check exposure.** Patched since October 2023, so the live question is whether a vCenter that ran before the patch was already entered by UNC3886; confirm your build, fence off the management ports, and check the crash logs.

- **Who must act:** Anyone still running vCenter Server below 8.0U1d, 8.0U2, 7.0U3o, 6.7U3t or 6.5U3v, and anyone whose vCenter was reachable from non-admin networks before late 2023.
- **Who can relax:** ESXi hosts, which VMware says are not affected, and vCenter instances on current 8.0 builds that sit on an isolated management network.
- **Affected:** vCenter Server 8.0 before 8.0U1d / 8.0U2; vCenter Server 7.0 before 7.0U3o; vCenter Server 6.7 before 6.7U3t (end of life); vCenter Server 6.5 before 6.5U3v (end of life); VMware Cloud Foundation 5.x, 4.x and 3.x (vCenter component)
- **Fixed:** vCenter Server 8.0U2 (build 22385739); vCenter Server 8.0U1d (build 22368047); vCenter Server 7.0U3o (build 22357613); vCenter Server 6.7U3t (build 22509723); vCenter Server 6.5U3v (build 22499743); VCF async patches per KB88287
- **CVEs:** CVE-2023-34048
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Check every vCenter build in the vSphere Client Summary tab or with PowerCLI ($global:DefaultVIServer.Build).
2. Upgrade to a current vCenter 8.0 build; 8.0U2, 8.0U1d and 7.0U3o are the minimum for this bug.
3. Restrict vCenter to a dedicated management network and block 2012/tcp, 2014/tcp and 2020/tcp from everything that does not need them.
4. Replace any vCenter 6.5 or 6.7 still in service; they are past end of support.
5. If the crash-log check below finds hits, treat vCenter and its ESXi hosts as compromised and bring in incident response.

### How to check if you are affected

- Search /var/log/vMonCoredumper.log (and rotated copies) on the appliance for 'vmdird dumping core' entries, which Mandiant saw minutes before UNC3886 backdoors appeared.
- Treat logged vmdird crashes whose core dump files are missing as suspicious; VMware keeps core dumps indefinitely by default and the actor deleted them.
- Review firewall and flow logs for connections to vCenter on 2012/tcp, 2014/tcp or 2020/tcp from sources outside your admin network.

## What happened

On October 25, 2023, VMware published [VMSA-2023-0023](https://www.vmware.com/security/advisories/VMSA-2023-0023.html) for CVE-2023-34048, an out-of-bounds write (CWE-787) in vCenter Server's implementation of the DCERPC protocol. VMware rates it critical, CVSS 3.1 9.8: "a malicious actor with network access to vCenter Server may trigger an out-of-bounds write potentially leading to remote code execution." No credentials are needed. Grigory Dorodnov of Trend Micro's Zero Day Initiative reported it. VMware found no viable in-product workaround, and because of that it also shipped patches for the end-of-life 6.5 and 6.7 lines.

On January 17, 2024, VMware updated the advisory to confirm exploitation in the wild. Two days later [Mandiant](https://cloud.google.com/blog/topics/threat-intelligence/chinese-vmware-exploitation-since-2021) named the user: UNC3886, a China-nexus espionage group, had exploited the bug since late 2021, roughly a year and a half before the patch. Mandiant had been tracing how the group planted backdoors on vCenter. The answer was in crash logs: the `vmdird` service crashed minutes before each backdoor appeared, and core dump analysis by Mandiant and VMware tied those crashes to this bug. CISA added it to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-34048) on January 22, 2024. It does not mark ransomware use.

## Who is affected

vCenter Server 8.0 before 8.0U1d or 8.0U2, 7.0 before 7.0U3o, 6.7 before 6.7U3t and 6.5 before 6.5U3v are affected, as is the vCenter inside VMware Cloud Foundation 5.x and 4.x (async patches via KB88287) and 3.x (separate patch). The [VMware FAQ](https://core.vmware.com/resource/vmsa-2023-0023-questions-answers) lists the fixed builds: 8.0U2 is 22385739, 8.0U1d is 22368047 and 7.0U3o is 22357613. It says ESXi is not affected and names the ports involved as 2012/tcp, 2014/tcp and 2020/tcp.

## Do you really need to act?

For patching, probably not: any vCenter updated since late 2023 has the fix. The documented exploitation is not a mass campaign but a patient espionage group that favors systems where EDR cannot run.

Two groups still need to act. The first runs old appliances: 6.5, 6.7 or 7.0 builds that missed the fix, often in labs or acquired environments. The second is anyone whose vCenter was reachable from user or server networks before the patch. The bug was exploited as a zero-day for at least a year and a half, and the actor deletes core dumps. For that group the question is not "are we patched?" but "were we already entered?"

## What to do now

1. Check each vCenter build in the vSphere Client Summary tab, or with PowerCLI: `Connect-VIServer vcenter.example.com`, then `$global:DefaultVIServer.Build`.
2. Upgrade to a current vCenter 8.0 build. 8.0U2, 8.0U1d and 7.0U3o are only the minimum for this bug.
3. Put vCenter on a dedicated management network, and block `2012/tcp`, `2014/tcp` and `2020/tcp` from everything that does not need them. VMware is clear that this reduces exposure but does not remove the bug.
4. Replace any remaining 6.5 or 6.7 vCenter; both are long past end of support.
5. If the checks below find anything, treat vCenter and every ESXi host it manages as compromised and bring in incident response.

## How to tell if you were hit

On the appliance shell, run `grep -i "vmdird dumping core" /var/log/vMonCoredumper.log*` (use `zgrep` for compressed rotations). Mandiant's example shows entries such as `Notify vMon about vmdird dumping core` followed by `Successfully generated core file`. A `vmdird` crash is not proof by itself, but VMware keeps core dumps indefinitely by default. A logged crash whose core dump is gone matches what Mandiant saw: the attacker deleted the dumps to cover their tracks. Also review firewall and flow logs for connections to the three DCERPC ports from outside your admin network. Any hit, especially from 2021 to 2023, justifies a full compromise assessment of vCenter and its ESXi hosts.

## Timeline

- Oct 25, 2023 — VMware publishes VMSA-2023-0023 with fixes, including patches for 6.5 and 6.7.
- Jan 17, 2024 — VMware updates the advisory to confirm in-the-wild exploitation.
- Jan 19, 2024 — Mandiant attributes exploitation to UNC3886 and publishes the crash-log indicator.
- Jan 22, 2024 — CISA adds CVE-2023-34048 to KEV (due February 12, 2024).

## Sources

1. [VMware — VMSA-2023-0023: vCenter Server updates address out-of-bounds write and information disclosure vulnerabilities](https://www.vmware.com/security/advisories/VMSA-2023-0023.html)
2. [VMware — VMSA-2023-0023: Questions & Answers](https://core.vmware.com/resource/vmsa-2023-0023-questions-answers)
3. [CVE record — CVE-2023-34048](https://www.cve.org/CVERecord?id=CVE-2023-34048)
4. [NVD — CVE-2023-34048](https://nvd.nist.gov/vuln/detail/CVE-2023-34048)
5. [CISA — Known Exploited Vulnerabilities: CVE-2023-34048](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-34048)
6. [Mandiant (Google Cloud) — Chinese espionage group UNC3886 found exploiting CVE-2023-34048 since late 2021](https://cloud.google.com/blog/topics/threat-intelligence/chinese-vmware-exploitation-since-2021)

---
Source page: https://erroneo.us/security/briefs/vcenter-cve-2023-34048-dcerpc-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt