erroneo.us
Search all guides⌘K

Security Digest · Sep 17, 2024 · Vulnerability · Cloud

vCenter CVE-2024-38812/38813: DCERPC RCE, Root Escalation

vCenter heap overflow and root escalation from Matrix Cup; first fix incomplete, exploited by Nov 2024. Confirm 8.0 U3d/7.0 U3t or later; now go to 8.0 U3k.

Published By erroneo.us Security Desk · Updated 3 min read11 sources

Our verdict

Check exposure

Fully fixed since October 2024 and exploited since; make sure no vCenter stopped at the incomplete September patch, and note that any build below 8.0 U3k is now exposed to the newer, exploited CVE-2026-59310.

Who must act: Owners of vCenter 7.0 or 8.0 below 7.0 U3t, 8.0 U2e or 8.0 U3d, especially anyone who applied only the September 2024 patch, and anyone whose vCenter is reachable beyond an admin network.

Who can relax: Teams on vCenter 8.0 U3k, 9.0.2.0100, 9.1.0.0300 or later with vCenter restricted to management networks, and organizations without on-premises vCenter.

Affected
vCenter Server 8.0 before 8.0 U3d (8.0 U2 line before 8.0 U2e)
vCenter Server 7.0 before 7.0 U3t
VMware Cloud Foundation 5.x and 4.x (vCenter component)
The September 2024 builds 8.0 U3b and 7.0 U3s did not fully fix CVE-2024-38812
Versions past general support, such as 6.5 and 6.7, were not evaluated and should be assumed affected
Fixed in
vCenter 8.0 U3d, 8.0 U2e and 7.0 U3t (Oct 21, 2024)
VCF async patches per KB88287
Recommended today: vCenter 8.0 U3k, 9.0.2.0100 or 9.1.0.0300, because of exploited CVE-2026-59310
CVSS
9.8 (v3.1, vendor)
EPSS
54.6% (percentile 99)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. Record every vCenter appliance's version and build with vpxd -v or the appliance management interface on port 5480.
  2. Treat anything below 8.0 U3d, 8.0 U2e or 7.0 U3t as unpatched for CVE-2024-38812, even if the September 2024 update was applied.
  3. Upgrade to 8.0 U3k, 9.0.2.0100 or 9.1.0.0300 or later; 7.0 has no public fix for the 2026 vCenter bugs.
  4. Restrict network access to vCenter to admin jump hosts and the ESXi management network.
  5. If vCenter was reachable and below the October 2024 builds after November 2024, run a compromise assessment of vCenter and its ESXi hosts.

How to check if you are affected or compromised

  • Broadcom has published no indicators for these CVEs; record that and hunt broadly rather than for a single artifact.
  • Check /var/log/vMonCoredumper.log* for unexplained service crashes and missing core files, the pattern Mandiant found with the earlier DCERPC bug CVE-2023-34048.
  • Review vSphere SSO users, the Administrators group and ESXi local accounts for entries nobody created.
  • Look for unexpected outbound connections from the vCenter appliance and new files under its web application or cron directories.

What happened#

On September 17, 2024, Broadcom published VMSA-2024-0019 for two vCenter Server bugs. CVE-2024-38812 is a heap overflow in vCenter's DCERPC protocol implementation. Someone with network access can send a crafted packet and "potentially" get remote code execution, with no login. Broadcom scores it CVSS 3.1 9.8. CVE-2024-38813 lets an attacker escalate to root with a crafted packet. Broadcom scores it 7.5 because it needs low privileges and high complexity; NVD rates it 9.8. Both were reported by zbl and srs of team TZL through China's 2024 Matrix Cup hacking contest.

The first fix did not hold. On October 21, 2024, Broadcom revised the advisory to say the September patches did not fully address CVE-2024-38812, and shipped new builds: 8.0 U3d, 8.0 U2e and 7.0 U3t. The CVE record still lists the September builds (8.0 U3b, 7.0 U3s) as the fix, so do not rely on it for versions. On November 18, Broadcom confirmed exploitation in the wild of both CVEs. It shared no indicators, attribution or victim details (BleepingComputer). CISA added both to the KEV catalog on November 20, 2024 (CVE-2024-38812, CVE-2024-38813). Who exploited them was not disclosed as of Oct 23, 2026.

Who is affected#

vCenter 8.0 before 8.0 U3d (8.0 U2e on the U2 line), 7.0 before 7.0 U3t, and the vCenter inside Cloud Foundation 4.x and 5.x. According to the Broadcom FAQ, ESXi is not affected. Versions past general support, such as 6.5 and 6.7, were not evaluated and should be assumed vulnerable. There is no workaround.

Do you really need to act?#

Usually just a check, but do it carefully. Many teams patched in September 2024 and moved on, leaving CVE-2024-38812 open. vCenter is a high-value target: Chinese espionage group UNC3886 used the earlier DCERPC bug CVE-2023-34048 as a zero-day for about a year and a half, according to Mandiant. Another DCERPC heap overflow from June 2024, CVE-2024-37079, joined KEV in January 2026.

The October 2024 builds are also no longer enough. VMSA-2026-0006 fixed CVE-2026-59310, in KEV since August 2026, in 8.0 U3k, 9.0.2.0100 and 9.1.0.0300. For 7.0 it lists no public fix and points extended-support customers to Broadcom Support.

What to do now#

  1. On each appliance, run vpxd -v or read the build in the management interface on port 5480.
  2. Treat any build below 8.0 U3d, 8.0 U2e or 7.0 U3t as vulnerable, whatever the September 2024 change ticket says.
  3. Upgrade to 8.0 U3k, 9.0.2.0100 or 9.1.0.0300 or later. Plan off 7.0. On VCF, use the async patches in KB88287.
  4. Limit access to vCenter to admin jump hosts and the ESXi management network.

How to tell if you were hit#

Broadcom published no indicators, so hunt broadly. On the appliance, run zgrep -i "dumping core" /var/log/vMonCoredumper.log*. With CVE-2023-34048, Mandiant saw the vmdird service crash minutes before backdoors appeared, with the core files deleted afterwards. A crash on a pre-October 2024 build is worth investigating. Also review vSphere SSO users, the Administrators group and local ESXi accounts. Look for outbound connections from vCenter you cannot explain. If anything turns up, rebuild vCenter from a known-good backup and rotate every credential it held.

Timeline#

  • — Broadcom publishes VMSA-2024-0019 with 8.0 U3b and 7.0 U3s.
  • — Broadcom says the first CVE-2024-38812 fix was incomplete and ships 8.0 U3d, 8.0 U2e and 7.0 U3t.
  • — Broadcom confirms in-the-wild exploitation of both CVEs.
  • — CISA adds both to KEV, with a December 11 deadline.
  • — VMSA-2026-0006 sets a new minimum of 8.0 U3k for vCenter 8.0.

Vulnerability records

  • CVE-2024-38812 · KEV 2024-11-20 · The vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol.
  • CVE-2024-38813 · KEV 2024-11-20 · The vCenter Server contains a privilege escalation vulnerability.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Broadcom — VMSA-2024-0019: vCenter Server updates address heap-overflow and privilege escalation vulnerabilities support.broadcom.com
  2. VMware — VMSA-2024-0019 questions and answers github.com
  3. CVE record — CVE-2024-38812 cve.org
  4. CVE record — CVE-2024-38813 cve.org
  5. NVD — CVE-2024-38812 nvd.nist.gov
  6. NVD — CVE-2024-38813 nvd.nist.gov
  7. CISA — Known Exploited Vulnerabilities: CVE-2024-38812 cisa.gov
  8. CISA — Known Exploited Vulnerabilities: CVE-2024-38813 cisa.gov
  9. Broadcom — VMSA-2026-0006: VMware vCenter and ESX vulnerabilities support.broadcom.com
  10. Mandiant — Chinese espionage group UNC3886 exploited vCenter zero-day since 2021 cloud.google.com

Coverage and analysis

  1. BleepingComputer — Critical RCE bug in VMware vCenter Server now exploited in attacks bleepingcomputer.com