Vulnerability record · CVE-2023-34048 · published 25 October 2023
CVE-2023-34048: VMware vCenter Server DCERPC out-of-bounds write
Vmware · Vcenter Server
vCenter Server contains an out-of-bounds write in its DCERPC protocol implementation. A remote, unauthenticated attacker with network access can trigger the flaw and potentially achieve remote code execution. Because vCenter is a central management plane, compromise has broad downstream impact.
Description
vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds write potentially leading to remote code execution.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8, unauthenticated network-reachable remote code execution, KEV listing and near-maximum EPSS make this an urgent patch-first issue.
What it is
vCenter Server contains an out-of-bounds write in its DCERPC protocol implementation. A remote, unauthenticated attacker with network access can trigger the flaw and potentially achieve remote code execution. Because vCenter is a central management plane, compromise has broad downstream impact.
Impact
An attacker gains remote code execution on the vCenter Server host, which can lead to control of managed ESXi hosts, virtual machines and stored credentials.
Attack surface
Reachable over the network via the DCERPC service; the CVSS vector shows no privileges and no user interaction required, so any host that can reach the vCenter DCERPC endpoint can attempt it.
Exploitation
It is listed in CISA KEV (added 2024-01-22) and has an EPSS 30-day probability of 0.99428 (99.9th percentile); a third-party reference is tagged Exploit, indicating public exploit material exists. No ransomware campaign use is documented.
What to do
- Apply the vendor patch per VMware advisory VMSA-2023-0023 as the first action.
- If patching is not immediately possible, follow the vendor's stated workarounds or discontinue use of the product, as directed by CISA KEV.
- Restrict network access to vCenter DCERPC ports to trusted management networks only.
- Isolate vCenter from general user and internet-facing networks and monitor for unauthorized access attempts.
- Verify patch status across all vCenter instances, including any that are internet-exposed.
Detection
- Monitor vCenter and DCERPC service logs for crashes, malformed requests or unexpected process restarts.
- Alert on anomalous outbound connections or new processes spawned by the vCenter service.
- Hunt for exploitation attempts against vCenter DCERPC ports from untrusted source addresses.
- Review vCenter audit and authentication logs for unexpected administrative or API activity following suspicious network events.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2023-34048 to the Known Exploited Vulnerabilities catalog on 22 January 2024 as "VMware vCenter Server Out-of-Bounds Write Vulnerability". Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 12 February 2024.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://www.vmware.com/security/advisories/VMSA-2023-0023.html | Vendor Advisory |
| https://www.vicarius.io/vsociety/posts/understanding-cve-2023-34048-a-zero-day-out-of-bound-write-in-vcenter-server | ExploitThird Party Advisory |
| https://www.vmware.com/security/advisories/VMSA-2023-0023.html | Vendor Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-34048 | US Government Resource |
Track CVE-2023-34048 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2023-34048), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
