---
title: "vCenter CVE-2024-38812/38813: DCERPC RCE, Root Escalation"
url: https://erroneo.us/security/briefs/vcenter-cve-2024-38812-38813-dcerpc-rce/
description: "vCenter heap overflow and root escalation from Matrix Cup; first fix incomplete, exploited by Nov 2024. Confirm 8.0 U3d/7.0 U3t or later; now go to 8.0 U3k."
type: security-brief
section: "Security Digest"
date_published: 2024-09-17
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2024-38812", "CVE-2024-38813"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# vCenter CVE-2024-38812/38813: DCERPC RCE, Root Escalation

**Verdict: Check exposure.** Fully fixed since October 2024 and exploited since; make sure no vCenter stopped at the incomplete September patch, and note that any build below 8.0 U3k is now exposed to the newer, exploited CVE-2026-59310.

- **Who must act:** Owners of vCenter 7.0 or 8.0 below 7.0 U3t, 8.0 U2e or 8.0 U3d, especially anyone who applied only the September 2024 patch, and anyone whose vCenter is reachable beyond an admin network.
- **Who can relax:** Teams on vCenter 8.0 U3k, 9.0.2.0100, 9.1.0.0300 or later with vCenter restricted to management networks, and organizations without on-premises vCenter.
- **Affected:** vCenter Server 8.0 before 8.0 U3d (8.0 U2 line before 8.0 U2e); vCenter Server 7.0 before 7.0 U3t; VMware Cloud Foundation 5.x and 4.x (vCenter component); The September 2024 builds 8.0 U3b and 7.0 U3s did not fully fix CVE-2024-38812; Versions past general support, such as 6.5 and 6.7, were not evaluated and should be assumed affected
- **Fixed:** vCenter 8.0 U3d, 8.0 U2e and 7.0 U3t (Oct 21, 2024); VCF async patches per KB88287; Recommended today: vCenter 8.0 U3k, 9.0.2.0100 or 9.1.0.0300, because of exploited CVE-2026-59310
- **CVEs:** CVE-2024-38812, CVE-2024-38813
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Record every vCenter appliance's version and build with vpxd -v or the appliance management interface on port 5480.
2. Treat anything below 8.0 U3d, 8.0 U2e or 7.0 U3t as unpatched for CVE-2024-38812, even if the September 2024 update was applied.
3. Upgrade to 8.0 U3k, 9.0.2.0100 or 9.1.0.0300 or later; 7.0 has no public fix for the 2026 vCenter bugs.
4. Restrict network access to vCenter to admin jump hosts and the ESXi management network.
5. If vCenter was reachable and below the October 2024 builds after November 2024, run a compromise assessment of vCenter and its ESXi hosts.

### How to check if you are affected

- Broadcom has published no indicators for these CVEs; record that and hunt broadly rather than for a single artifact.
- Check /var/log/vMonCoredumper.log* for unexplained service crashes and missing core files, the pattern Mandiant found with the earlier DCERPC bug CVE-2023-34048.
- Review vSphere SSO users, the Administrators group and ESXi local accounts for entries nobody created.
- Look for unexpected outbound connections from the vCenter appliance and new files under its web application or cron directories.

## What happened

On September 17, 2024, Broadcom published [VMSA-2024-0019](https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24968) for two vCenter Server bugs. CVE-2024-38812 is a heap overflow in vCenter's DCERPC protocol implementation. Someone with network access can send a crafted packet and "potentially" get remote code execution, with no login. Broadcom scores it CVSS 3.1 9.8. CVE-2024-38813 lets an attacker escalate to root with a crafted packet. Broadcom scores it 7.5 because it needs low privileges and high complexity; [NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-38813) rates it 9.8. Both were reported by zbl and srs of team TZL through China's 2024 Matrix Cup hacking contest.

The first fix did not hold. On October 21, 2024, Broadcom revised the advisory to say the September patches did not fully address CVE-2024-38812, and shipped new builds: 8.0 U3d, 8.0 U2e and 7.0 U3t. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2024-38812) still lists the September builds (8.0 U3b, 7.0 U3s) as the fix, so do not rely on it for versions. On November 18, Broadcom confirmed exploitation in the wild of both CVEs. It shared no indicators, attribution or victim details ([BleepingComputer](https://www.bleepingcomputer.com/news/security/critical-rce-bug-in-vmware-vcenter-server-now-exploited-in-attacks/)). CISA added both to the KEV catalog on November 20, 2024 ([CVE-2024-38812](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38812), [CVE-2024-38813](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38813)). Who exploited them was not disclosed as of Oct 23, 2026.

## Who is affected

vCenter 8.0 before 8.0 U3d (8.0 U2e on the U2 line), 7.0 before 7.0 U3t, and the vCenter inside Cloud Foundation 4.x and 5.x. According to the [Broadcom FAQ](https://github.com/vmware/vcf-security-and-compliance-guidelines/blob/main/security-advisories/vmsa-2024-0019/README.md), ESXi is not affected. Versions past general support, such as 6.5 and 6.7, were not evaluated and should be assumed vulnerable. There is no workaround.

## Do you really need to act?

Usually just a check, but do it carefully. Many teams patched in September 2024 and moved on, leaving CVE-2024-38812 open. vCenter is a high-value target: Chinese espionage group UNC3886 used the earlier DCERPC bug CVE-2023-34048 as a zero-day for about a year and a half, according to [Mandiant](https://cloud.google.com/blog/topics/threat-intelligence/chinese-vmware-exploitation-since-2021). Another DCERPC heap overflow from June 2024, CVE-2024-37079, joined KEV in January 2026.

The October 2024 builds are also no longer enough. [VMSA-2026-0006](https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017) fixed CVE-2026-59310, in KEV since August 2026, in 8.0 U3k, 9.0.2.0100 and 9.1.0.0300. For 7.0 it lists no public fix and points extended-support customers to Broadcom Support.

## What to do now

1. On each appliance, run `vpxd -v` or read the build in the management interface on port 5480.
2. Treat any build below 8.0 U3d, 8.0 U2e or 7.0 U3t as vulnerable, whatever the September 2024 change ticket says.
3. Upgrade to 8.0 U3k, 9.0.2.0100 or 9.1.0.0300 or later. Plan off 7.0. On VCF, use the async patches in KB88287.
4. Limit access to vCenter to admin jump hosts and the ESXi management network.

## How to tell if you were hit

Broadcom published no indicators, so hunt broadly. On the appliance, run `zgrep -i "dumping core" /var/log/vMonCoredumper.log*`. With CVE-2023-34048, Mandiant saw the `vmdird` service crash minutes before backdoors appeared, with the core files deleted afterwards. A crash on a pre-October 2024 build is worth investigating. Also review vSphere SSO users, the Administrators group and local ESXi accounts. Look for outbound connections from vCenter you cannot explain. If anything turns up, rebuild vCenter from a known-good backup and rotate every credential it held.

## Timeline

- Sep 17, 2024 — Broadcom publishes VMSA-2024-0019 with 8.0 U3b and 7.0 U3s.
- Oct 21, 2024 — Broadcom says the first CVE-2024-38812 fix was incomplete and ships 8.0 U3d, 8.0 U2e and 7.0 U3t.
- Nov 18, 2024 — Broadcom confirms in-the-wild exploitation of both CVEs.
- Nov 20, 2024 — CISA adds both to KEV, with a December 11 deadline.
- Jul 29, 2026 — VMSA-2026-0006 sets a new minimum of 8.0 U3k for vCenter 8.0.

## Sources

1. [Broadcom — VMSA-2024-0019: vCenter Server updates address heap-overflow and privilege escalation vulnerabilities](https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24968)
2. [VMware — VMSA-2024-0019 questions and answers](https://github.com/vmware/vcf-security-and-compliance-guidelines/blob/main/security-advisories/vmsa-2024-0019/README.md)
3. [CVE record — CVE-2024-38812](https://www.cve.org/CVERecord?id=CVE-2024-38812)
4. [CVE record — CVE-2024-38813](https://www.cve.org/CVERecord?id=CVE-2024-38813)
5. [NVD — CVE-2024-38812](https://nvd.nist.gov/vuln/detail/CVE-2024-38812)
6. [NVD — CVE-2024-38813](https://nvd.nist.gov/vuln/detail/CVE-2024-38813)
7. [CISA — Known Exploited Vulnerabilities: CVE-2024-38812](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38812)
8. [CISA — Known Exploited Vulnerabilities: CVE-2024-38813](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38813)
9. [Broadcom — VMSA-2026-0006: VMware vCenter and ESX vulnerabilities](https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017)
10. [Mandiant — Chinese espionage group UNC3886 exploited vCenter zero-day since 2021](https://cloud.google.com/blog/topics/threat-intelligence/chinese-vmware-exploitation-since-2021)
11. [BleepingComputer — Critical RCE bug in VMware vCenter Server now exploited in attacks](https://www.bleepingcomputer.com/news/security/critical-rce-bug-in-vmware-vcenter-server-now-exploited-in-attacks/)

---
Source page: https://erroneo.us/security/briefs/vcenter-cve-2024-38812-38813-dcerpc-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt