CVE-2024-38813: VMware vCenter Server privilege escalation to root via crafted packet

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

critical priorityCVSS 9.8, network-reachable with no authentication or interaction, and confirmed exploitation in CISA KEV make this an urgent patch.

What it is

vCenter Server contains a privilege escalation flaw where a malicious actor with network access can send a specially crafted network packet to escalate privileges to root. It matters because vCenter is a central management plane, and root-level compromise there can expose the whole virtualized estate. The record does not specify the exact vulnerable component or affected versions beyond the listed products.

Impact

An attacker gains root privileges on vCenter Server, which can lead to full control of the management plane and the connected virtualization infrastructure.

Attack surface

Reachable over the network with no authentication and no user interaction required, per the CVSS vector (AV:N/AC:L/PR:N/UI:N). The description confirms network access to vCenter Server is sufficient.

Exploitation

Listed in CISA KEV with a due date of 2024-12-11, indicating known exploitation in the wild. EPSS is 0.17355 (96.9th percentile), and no ransomware campaign use is documented.

What to do

• Apply the vendor patch from the Broadcom/VMware advisory as the first action.
• If patching is not immediately possible, follow the vendor's required action and consider discontinuing use of the product per CISA KEV guidance.
• Restrict network access to vCenter Server management interfaces to trusted networks and administrative hosts.
• Monitor for and investigate unexpected root-level activity or configuration changes on vCenter Server.
• Review vCenter exposure to untrusted networks and remove any unnecessary internet-facing access.

Detection

• Monitor vCenter Server logs and system logs for unexpected privilege changes or root-level process execution.
• Alert on anomalous or malformed network traffic to vCenter management interfaces from untrusted sources.
• Track authentication and administrative actions in vCenter for signs of post-exploitation activity.
• Correlate vCenter host telemetry with network monitoring for crafted-packet patterns preceding privilege escalation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.