CVE-2024-37079: VMware vCenter Server DCERPC heap overflow allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction, active inclusion in CISA KEV, and a high EPSS score make this an urgent patch target.

What it is

vCenter Server contains a heap-overflow (out-of-bounds write) in its DCERPC protocol implementation. A remote, unauthenticated attacker can send a crafted network packet to trigger memory corruption that may lead to code execution on the vCenter host. Because vCenter is a central management plane for virtual infrastructure, compromise has broad downstream impact.

Impact

An attacker gains the ability to execute arbitrary code on the vCenter Server, potentially taking full control of the management plane and the virtualized environment it governs.

Attack surface

Reachable over the network via the DCERPC service; the CVSS vector indicates no authentication and no user interaction are required. Any host with network access to the vCenter Server's DCERPC endpoint can attempt the attack.

Exploitation

The vulnerability is listed in CISA KEV with a remediation due date, indicating known exploitation in the wild; EPSS is 0.224 (97.6th percentile), consistent with elevated exploitation likelihood. No ransomware campaign use is documented.

What to do

• Apply the Broadcom/VMware vendor patch referenced in the security advisory as the first action.
• If patching is not immediately possible, follow the vendor's published workarounds or restrict network access to the vCenter DCERPC service.
• Isolate vCenter management interfaces from untrusted networks and enforce strict firewall rules limiting who can reach them.
• Per CISA BOD 22-01 guidance, treat exposed vCenter instances as high priority and discontinue use if mitigations are unavailable.

Detection

• Monitor network traffic to vCenter DCERPC ports for malformed or unusually large packets.
• Alert on unexpected processes, child processes, or outbound connections originating from the vCenter Server.
• Review vCenter and ESXi logs for crashes, service restarts, or anomalous authentication and management activity.
• Hunt for indicators of post-exploitation activity on vCenter hosts, including new accounts, scheduled tasks, or modified services.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.