CVE-2024-38812: VMware vCenter Server DCERPC heap overflow allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction, confirmed in-the-wild exploitation per CISA KEV, and a high EPSS score make this an urgent patch target.

What it is

vCenter Server contains a heap-based buffer overflow (CWE-122/CWE-787) in its DCERPC protocol implementation. A remote, unauthenticated attacker can send a crafted network packet to trigger the overflow, with the potential for remote code execution. Because vCenter is a central management plane for virtualized estates, compromise has wide blast radius.

Impact

An attacker gains the ability to corrupt heap memory and potentially execute arbitrary code on the vCenter Server host, which can lead to full control of the management plane and the virtual infrastructure it governs.

Attack surface

Reachable over the network via the DCERPC service; the CVSS vector (AV:N/PR:N/UI:N) indicates no authentication and no user interaction are required. Any host with network access to the vCenter Server DCERPC endpoint is a potential source.

Exploitation

CVE-2024-38812 is listed in CISA KEV (added 2024-11-20, due 2024-12-11), confirming exploitation in the wild, and EPSS shows a 30-day probability of 0.546 (98.96th percentile). KEV notes no known ransomware campaign use.

What to do

• Apply the vendor patch from the Broadcom/VMware security advisory for vCenter Server and Cloud Foundation as the first action.
• If patching cannot be completed by the KEV due date, follow vendor mitigations or discontinue use of the affected product per CISA guidance.
• Restrict network access to vCenter Server management and DCERPC interfaces to trusted administrative networks only.
• Monitor for and investigate any signs of post-exploitation activity on vCenter hosts, treating them as high-value targets.
• Verify patch status across all vCenter and Cloud Foundation instances, including any that are internet-exposed.

Detection

• Monitor network traffic to vCenter DCERPC ports for malformed or unusually sized packets consistent with heap overflow attempts.
• Alert on unexpected process creation, new services, or outbound connections originating from vCenter Server hosts.
• Review vCenter and ESXi logs for crashes, restarts, or anomalous authentication and API activity around the DCERPC service.
• Hunt for known exploitation indicators and IOCs published by VMware/Broadcom and CISA for this CVE.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.