SecOps SignalSecurity Intelligence Workspace
Loading collection status
Vulnerabilities/CVE-2024-37079Public Intelligence Dossier
Source: vmware · Limited verification•Last verified: •Collection Degraded
CVE-2024-37079ListedCRITICAL (raw)CVSS 9.8CWE-787

vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol

Published: 18 Jun 2024•Last updated: 17 Jun 2026, 01:07 PM IST•Source identifier: security@vmware.com
Dossier completeness: source-provided sections 3 / 3 · rule guidance available. Missing source facts count as incomplete.
Official source
CISA KEV catalog
Listed
Added23 Jan 2026
Due13 Feb 2026
RansomwareUnknown
CVSS score
9.8CRITICAL (raw)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Metric sourcesecurity@vmware.com
EPSS probability
22.4%0.224
Percentile98th
Weakness type
CWE-787
No further CWE recorded
Remediation
Patch status unknown
No fixed version or KB recorded

Why It Matters

Analysis dossier

Why It Matters

vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution.

SOC priority

Immediate Attention

Actively exploited (source statement)

Yes

Publicly disclosed

Unknown

Risk basis: CISA KEV exploitation signal; SOC ecosystem technology relevance; CRITICAL severity; Known exploitation signal from CISA KEV or ransomware metadata; Source-confirmed exploitation or CISA KEV/ransomware metadata

Affected Products & Remediation

2 source-backed products
Affected products and versions (source)
  • vmware cloud foundation · >= 4.0 < 5.2 · NVD CPE · Source
  • vmware vcenter server · 8.0; 7.0 · NVD CPE · Source
Recorded patch / KBNot provided by source

Vendor or catalog guidance (source)

  • CISA KEV: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Known exploitation (source facts)

Only what a source states. Unknown means no source has said either way; it is not "not exploited".

CISA KEV
Listed
Exploited (source statement)
Yes
Publicly disclosed (source)
Unknown

CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Suggested hunting (rule-based inference)

SecOps Signal recommendation (rule-based inference). These steps are hunting hypotheses from the vulnerability class; they do not state or imply that exploitation occurred here or anywhere.

Matched kev-network-exposure (CVSS AV:N, CISA KEV Listed); network-unauthenticated (CVSS AV:N, CVSS PR:N, CVSS UI:N)

Exposure

  1. Identify assets with the exact CVE and confirm the affected product/version against the advisory.Telemetry: DeviceTvmSoftwareVulnerabilities · KEV listing raises urgency, but inventory is needed to establish local exposure. · Rule kev-network-exposure
  2. Identify devices reporting this CVE and note which expose the affected service to untrusted networks.Telemetry: DeviceTvmSoftwareVulnerabilities · A network-reachable, no-privilege vector makes internet-facing instances the first exposure question. · Rule network-unauthenticated

Exploitation evidence

  1. Review relevant edge or application access logs for unusual requests around the advisory window.Telemetry: CommonSecurityLog · Log review is a hunting hypothesis; KEV listing alone does not show local exploitation. · Rule kev-network-exposure
Show more (2)

Exploitation evidence

  1. Review inbound connections to the affected service from unexpected sources since the advisory date.Telemetry: DeviceNetworkEvents · Hunting hypothesis from the CVSS vector; it does not show that exploitation occurred. · Rule network-unauthenticated

Response

  1. Recheck the affected assets after the source-stated mitigation or update is applied.Telemetry: DeviceTvmSoftwareVulnerabilities · A follow-up inventory check verifies local remediation. · Rule kev-network-exposure

CISA KEV Record

Catalog entry
23 Jan 2026
Required action due
13 Feb 2026
Known ransomware use
Unknown

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Change History & Source Data

— No recorded material change

CNA / source
security@vmware.com
Record status · verification
UPDATED · CISA KEV confirmed
CPE
cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*, cpe:2.3:a:vmware:vcenter_server:8.0:-:*:*:*:*:*:*, cpe:2.3:a:vmware:vcenter_server:8.0:a:*:*:*:*:*:*, cpe:2.3:a:vmware:vcenter_server:8.0:b:*:*:*:*:*:*, cpe:2.3:a:vmware:vcenter_server:8.0:c:*:*:*:*:*:*, cpe:2.3:a:vmware:vcenter_server:8.0:update1:*:*:*:*:*:*, cpe:2.3:a:vmware:vcenter_server:8.0:update1a:*:*:*:*:*:*, cpe:2.3:a:vmware:vcenter_server:8.0:update1b:*:*:*:*:*:*, cpe:2.3:a:vmware:vcenter_server:8.0:update1c:*:*:*:*:*:*, cpe:2.3:a:vmware:vcenter_server:8.0:update1d:*:*:*:*:*:*

Evidence & Provenance

4 public sources
CISA KEV CatalogAdded 2026-01-23support.broadcom.comSource recordnvd.nist.govSource recordcisa.govSource record

Linked by the query's stored exact CVE association. Review required tables and validation status before use.

Detection Hunting Query
Target: DeviceTvmSoftwareVulnerabilities•Defender XDR
Detect endpoints exposed to CVE-2024-37079
Purpose: Exposure assessment (Category: Exposure Check)Why linked: Query metadata names CVE-2024-37079
DeviceTvmSoftwareVulnerabilities| where CveId == "CVE-2024-37079"| project DeviceId, DeviceName, OSPlatform, OSVersion, SoftwareVendor, SoftwareName, SoftwareVersion, CveId, VulnerabilitySeverityLevel, RecommendedSecurityUpdate, RecommendedSecurityUpdateId| sort by VulnerabilitySeverityLevel desc
Schema Checked · Not runtime validatedSource: SecOps Signal deterministic template · Limited verificationStatic screening: Passed structure and schema checks; tenant execution is not verified.
Open KQL Library

Looking up related community queries…

Loading related intelligence

Correlated briefings

SecOps Signal surfaces public advisory facts only. A missing value means the source has not published it, not that your environment is unaffected. No tenant inventory is connected.