CVE-2024-37079Active Exploitation(vmware / cloud_foundation)

I'm getting more and more contacts about this being actively used, so patch, patch, patch! VMSA-2024-0012:VMware vCenter Server updates address heap-overflow and privilege escalation vulnerabilities (CVE-2024-37079, CVE-2024-37080, CVE-2024-37081) #broadcom #vmware https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/securityadvisories/0/24453

Uralte Schwachstellen aus 2024 werden wohl in VMware vCenter Server angegriffen https://borncity.com/blog/2026/02/25/angriffe-auf-vmware-vcenter-server-schwachstellen-cve-2024-37079-cve-2024-37080-cve-2024-37081/

CISA orders patching of VMware vCenter critical RCE flaw (CVE-2024-37079) after June DCERPC heap-overflow fix. 1Password adds phishing alerts as AI phishing rises. Microsoft fixes Windows 11 boot issues with KB5074109. #VMware #US #PhishingProtection https://ift.tt/cph5m6B

VMware by Broadcom has confirmed in-the-wild exploitation of CVE-2024-37079 in VMware vCenter Server, and CISA has flagged it as actively exploited with a hard remediation deadline for U.S. federal agencies of February 13, 2026. That combination (vendor confirmation + KEV-style urgency + ransomware chatter) is the signal: attackers aren’t testing this anymore, they’re operationalizing it. Continue reading at https://angrysysops.com/2026/02/05/vcenter-server-cve-2024-37079-is-now-getting-weaponized-in-ransomware-campaigns-patch-like-you-mean-it/ | Angry Admin

CISA adds CVE-2024-37079, a critical heap-overflow RCE in VMware vCenter Server, to its KEV catalog after confirming active exploitation. The flaw enables unauthenticated remote code execution and lateral movement. #VMwareFlaw #RemoteCodeExec #USA https://ift.tt/9FThBAX

What happened CISA added CVE-2024-37079 to the Known Exploited Vulnerabilities catalog on 2026-01-23, flagging active exploitation and mandating federal remediation timelines CISA KEV. The vulnerability is an out-of-bounds write in Broadcom VMware vCenter Server’s…

CVE-2024-37079: Out-of-bounds write in vCenter Server’s DCERPC implementation enables network-triggered RCE; CISA added CVE-2024-37079 to the KEV on 2026-01-23.

CISA KEV 警告 26/01/23：VMware：vCenter の脆弱性 CVE-2024-37079 を登録 https://iototsecnews.jp/2026/01/24/cisa-adds-actively-exploited-vmware-vcenter-flaw-cve-2024-37079-to-kev-catalog/ 仮想化環境の管理を担う VMware vCenter Server において、外部からシステムを完全に乗っ取られる恐れのある深刻な脆弱性が、現在進行形で攻撃に悪用されていることが確認されました。この問題の原因は、vCenter Serverが通信で使用する DCE/RPC プロトコルの処理プログラムに、メモリ管理の不備であるヒープ・オーバーフローが存在していた点にあります。 この脆弱性 CVE-2024-37079 は、最大級の深刻度を示す CVSS スコア 9.8 と評価されています。攻撃者は、ネットワーク経由で細工したパケットを送信するだけで、パスワードなどの認証なしに、サーバ上で任意のプログラムの実行を引き起こせます。さらに、他の脆弱性と組み合わせることで、最高権限である root 権限を奪い、最終的には管理下の仮想マシンが動く ESXiホスト 全体の制御の奪取を可能にします。ご利用のチームは、ご注意ください。 #CISA #CVE202437079 #Exploit #Government #KEV #vCenterServer #VMware #Vulnerability

Emergency patches released for Microsoft Office zero-day CVE-2026-21509 and VMware vCenter flaw CVE-2024-37079 exploited in the wild. Dormakaba door access flaws, Stanley malware, Nike data breach, and Sandworm attacks on Poland's power grid also reporte… https://ift.tt/Auhgql6

VMware vCenter Serverの1年前の脆弱性(CVE-2024-37079)がKEVに追加 https://rocket-boys.co.jp/security-measures-lab/vmware-vcenter-server-one-year-old-vulnerability-added-to-kev-cve-2024-37079/ #セキュリティ対策Lab #セキュリティ #Security #サイバー攻撃 #CybersecurityNews

https://lyrie.ai/research/research/active-exploit-cve-2024-37079-vmware-vcenter-server #lyrie #cybersecurity #CVE #threatintel #zerodayattack

CVE-2024-37079: VMware vCenter heap overflow. One unauthenticated network packet → RCE. Actively exploited. The nerve center of your virtualization owned by a single crafted packet. Broadcom confirms ITW. Patch or pray—attackers already have admin on your hypervisors.

#threatreport #MediumCompleteness January 2026 CVE Landscape: 23 Critical Vulnerabilities Mark 5% Increase, APT28 Exploits Microsoft Office Zero-Day | 24-02-2026 Source: https://www.recordedfuture.com/blog/january-2026-cve-landscape Key details below ↓ 🧑‍💻Actors/Campaigns: Fancy_bear Neusploit 💀Threats: Nuclei_tool, Minidoor, Pixynetloader, Covenant_c2_tool, Grunt, Com_hijacking_technique, Supply_chain_technique, 🎯Victims: Enterprise communication platforms, Enterprise management platforms, Government users, Business users, Wordpress sites, Email systems 🏭Industry: Government 🌐Geo: Russian 🔓CVEs: CVE-2026-23760 \[[Vulners](https://vulners.com/cve/CVE-2026-23760)] - CVSS V3.1: *9.8*, - Vulners: Exploitation: True Soft: - smartertools smartermail (<100.0.9511) CVE-2025-34026 \[[Vulners](https://vulners.com/cve/CVE-2025-34026)] - CVSS V3.1: *7.5*, - Vulners: Exploitation: True Soft: - versa-networks concerto (<12.1.2, 12.2.0) CVE-2009-0556 \[[Vulners](https://vulners.com/cve/CVE-2009-0556)] - CVSS V3.1: *8.8*, - Vulners: Exploitation: True Soft: - microsoft office_powerpoint (2004) - microsoft powerpoint (2000, 2002, 2003) CVE-2025-8110 \[[Vulners](https://vulners.com/cve/CVE-2025-8110)] - CVSS V3.1: *8.8*, - Vulners: Exploitation: True Soft: - gogs (le0.13.3) CVE-2026-24423 \[[Vulners](https://vulners.com/cve/CVE-2026-24423)] - CVSS V3.1: *9.8*, - Vulners: Exploitation: True Soft: - smartertools smartermail (<100.0.9511) CVE-2025-68645 \[[Vulners](https://vulners.com/cve/CVE-2025-68645)] - CVSS V3.1: *8.8*, - Vulners: Exploitation: True Soft: - synacor zimbra_collaboration_suite (<10.0.18, <10.1.13) CVE-2018-14634 \[[Vulners](https://vulners.com/cve/CVE-2018-14634)] - CVSS V3.1: *7.8*, - Vulners: Exploitation: True Soft: - paloaltonetworks pan-os (<7.1.23, <8.0.16, <8.1.7) CVE-2026-21509 \[[Vulners](https://vulners.com/cve/CVE-2026-21509)] - CVSS V3.1: *7.8*, - Vulners: Exploitation: True Soft: - microsoft 365_apps (-) - microsoft office (2016, 2019) - microsoft office_long_term_servicing_channel (2021, 2024) CVE-2025-37164 \[[Vulners](https://vulners.com/cve/CVE-2025-37164)] - CVSS V3.1: *10.0*, - Vulners: Exploitation: True Soft: - hpe oneview (le10.20.00) CVE-2026-1340 \[[Vulners](https://vulners.com/cve/CVE-2026-1340)] - CVSS V3.1: *9.8*, - Vulners: Exploitation: True Soft: - ivanti endpoint_manager_mobile (le12.7.0.0) CVE-2026-1281 \[[Vulners](https://vulners.com/cve/CVE-2026-1281)] - CVSS V3.1: *9.8*, - Vulners: Exploitation: True Soft: - ivanti endpoint_manager_mobile (le12.5.0.0, 12.5.1.0, 12.6.0.0, 12.6.1.0, 12.7.0.0) CVE-2026-20045 \[[Vulners](https://vulners.com/cve/CVE-2026-20045)] - CVSS V3.1: *9.8*, - Vulners: Exploitation: True Soft: - cisco unified_communications_manager (<14su5, le15su3a) - cisco unified_communications_manager_im_and_presence_service (<14su5, le15su3a) - cisco unity_connection (<14su5, le15su3) CVE-2026-20931 \[[Vulners](https://vulners.com/cve/CVE-2026-20931)] - CVSS V3.1: *8.0*, - Vulners: Exploitation: Unknown Soft: - microsoft windows_10_1607 (<10.0.14393.8783) - microsoft windows_10_1809 (<10.0.17763.8276) - microsoft windows_10_21h2 (<10.0.19044.6809) - microsoft windows_10_22h2 (<10.0.19045.6809) ... CVE-2026-20805 \[[Vulners](https://vulners.com/cve/CVE-2026-20805)] - CVSS V3.1: *5.5*, - Vulners: Exploitation: True Soft: - microsoft windows_10_1607 (<10.0.14393.8783) - microsoft windows_10_1809 (<10.0.17763.8276) - microsoft windows_10_21h2 (<10.0.19044.6809) - microsoft windows_10_22h2 (<10.0.19045.6809) ... CVE-2025-52691 \[[Vulners](https://vulners.com/cve/CVE-2025-52691)] - CVSS V3.1: *10.0*, - Vulners: Exploitation: True Soft: - smartertools smartermail (<100.0.9413) CVE-2025-31125 \[[Vulners](https://vulners.com/cve/CVE-2025-31125)] - CVSS V3.1: *7.5*, - Vulners: Exploitation: True Soft: - vitejs vite (<4.5.11, <5.4.16, <6.0.13, <6.1.3, <6.2.4) CVE-2026-24858 \[[Vulners](https://vulners.com/cve/CVE-2026-24858)] - CVSS V3.1: *9.8*, - Vulners: Exploitation: True Soft: - fortinet fortianalyzer (le7.0.15, le7.2.11, <7.4.10, <7.6.6) - fortinet fortimanager (le7.0.15, le7.2.11, <7.4.10, <7.6.6) - fortinet fortiproxy (le7.0.22, le7.2.15, le7.4.12, le7.6.4) - fortinet fortiweb (le7.4.11, le7.6.6, le8.0.3) ... CVE-2025-54313 \[[Vulners](https://vulners.com/cve/CVE-2025-54313)] - CVSS V3.1: *7.5*, - Vulners: Exploitation: True Soft: - prettier eslint-config-prettier (8.10.1, 9.1.1, 10.1.6, 10.1.7) CVE-2025-40551 \[[Vulners](https://vulners.com/cve/CVE-2025-40551)] - CVSS V3.1: *9.8*, - Vulners: Exploitation: True Soft: - solarwinds web_help_desk (<2026.1) CVE-2026-20029 \[[Vulners](https://vulners.com/cve/CVE-2026-20029)] - CVSS V3.1: *4.9*, - Vulners: Exploitation: Unknown CVE-2026-23550 \[[Vulners](https://vulners.com/cve/CVE-2026-23550)] - CVSS V3.1: *10.0*, - Vulners: Exploitation: Unknown CVE-2026-23800 \[[Vulners](https://vulners.com/cve/CVE-2026-23800)] - CVSS V3.1: *10.0*, - Vulners: Exploitation: Unknown CVE-2024-37079 \[[Vulners](https://vulners.com/cve/CVE-2024-37079)] - CVSS V3.1: *9.8*, - Vulners: Exploitation: True Soft: - vmware cloud_foundation (<5.2) CVE-2026-24061 \[[Vulners](https://vulners.com/cve/CVE-2026-24061)] - CVSS V3.1: *9.8*, - Vulners: Exploitation: True Soft: - gnu inetutils (le2.7) 🤖LLM extracted TTPs:` T1005, T1027, T1053.005, T1071.001, T1078, T1090, T1098, T1112, T1114.003, T1133, ... 🧨IOCs: - Path: 2 - Registry: 1 - IP: 6 - Email: 4 - File: 2 💽Software: Microsoft Office, Ivanti, Linux, Zimbra Collaboration Suite, WordPress, Outlook, Ivanti EPMM 🔢Algorithms: xor 📜Programming Languages: php #threatreport: In January 2026, there was a noted 5% increase in critical vulnerabilities, with 23 high-impact issues identified. Among these, the exploitation of a significant Microsoft Office zero-day vulnerability (CVE-2026-21509) by Russian state-sponsored group APT28 highlighted ongoing threats to enterprise technologies. This vulnerability, which relates to the reliance on untrusted inputs in security decisions, enabled APT28 to utilize weaponized Rich Text Format (RTF) files to deliver various malicious implants, including MiniDoor, PixyNetLoader, and Covenant Grunt. The exploitation chain initiated with an RTF file that bypassed Office OLE mitigations. The attackers deployed MiniDoor as an Outlook VBA script for email collection, while PixyNetLoader, which created a mutex for persistence, allowed further attacks. A notable aspect of this operation was the use of geography-based evasion to limit the delivery of the malicious payloads, demonstrating the sophistication of the APT28 attacks. In addition to Microsoft, other vendors such as SmarterTools and Ivanti were significantly affected, with SmarterTools reporting multiple critical vulnerabilities allowing authentication bypass and remote code execution (RCE). Specifically, CVE-2026-23760 identified a privilege escalation flaw in SmarterMail, permitting unauthenticated users to reset passwords, demonstrating serious flaws in expected security protocols. Furthermore, the Modular DS WordPress plugin was found to have multiple vulnerabilities, CVE-2026-23550 and CVE-2026-23800, that allowed attackers to gain administrator access without authentication. These vulnerabilities emphasize the risk of widespread exploitation due to the centralized management of multiple WordPress sites.

@VMware vCenter just hit CISA's KEV list. If you're running virtual infrastructure and haven't patched CVE-2024-37079, attackers can write to memory they shouldn't touch. That's every VM, every workload, every app. How fast can you move when your entire data center is the target?

🚨 vCenter under attack. CVE-2024-37079 is now actively exploited in ransomware campaigns. One unpatched vCenter = full virtual estate at risk. If it’s still on your “later” list, later is too late. Patch. Verify. Lock it down. 🔐 https://angrysysops.com/2026/02/05/vcenter-server-cve-2024-37079-is-now-getting-weaponized-in-ransomware-campaigns-patch-like-you-mean-it/ #VMware #CyberSecurity #Ransomware #vCenter #InfoSec #vExpert @vExpert

🚨 vCenter Server CVE-2024-37079: ITW DCERPC heap-o/f → net RCE. Exposed: reachable vCenter 7/8 + VCF. Patch: 8.0U2d/8.0U1e/7.0U3r (VCF KB88287). If not patched now: firewall vCenter to admin IPs only. https://www.cyber.gc.ca/en/alerts-advisories/vmware-security-advisory-av24-345

📡 𝗡𝗲𝘄𝘀𝗹𝗲𝘁𝘁𝗲𝗿 Podcast 𝗥𝗮𝗱𝗶𝗼𝗖𝗦𝗜𝗥𝗧 𝗻°𝟰𝟳 | 𝗦𝗲𝗺𝗮𝗶𝗻𝗲 𝗱𝘂 𝟮𝟰 𝗮𝘂 𝟯𝟬 𝗷𝗮𝗻𝘃𝗶𝗲𝗿 𝟮𝟬𝟮𝟲 Récapitulatif des épisodes 558 à 564 du podcast quotidien RadioCSIRT. 𝗩𝘂𝗹𝗻𝗲́𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝗲́𝘀 𝗰𝗿𝗶𝘁𝗶𝗾𝘂𝗲𝘀 𝗲𝘁 𝗞𝗘𝗩 CVE-2026-21962 (Oracle) : PoC publié 24h après le patch CVE-2024-37079 (VMware vCenter, CVSS 9.8) : exploitation par 3 APT chinois confirmée CVE-2026-24061 (GNU InetUtils telnetd) : 800K serveurs exposés, exploitation active CVE-2026-21509 (Microsoft Office) : zero-day exploité activement CVE-2026-24858 (Fortinet) : contournement authentification SSO FortiCloud 𝗖𝗼𝗿𝗿𝗲𝗰𝘁𝗶𝗳𝘀 𝗱'𝘂𝗿𝗴𝗲𝗻𝗰𝗲 Microsoft KB5078127 : seconde mise à jour hors-bande en une semaine SolarWinds Web Help Desk : 6 vulnérabilités dont 4 critiques (RCE non authentifiée) 6000+ serveurs SmarterMail exposés (CVE-2025-52691, CVE-2026-23760) 𝗠𝗲𝗻𝗮𝗰𝗲𝘀 𝗮𝗰𝘁𝗶𝘃𝗲𝘀 DynoWiper (Sandworm) : attaque secteur énergétique polonais Kimwolf : 2M+ dispositifs IoT infectés, présence dans 25% réseaux corporate UAT-8099 (Chine) : ciblage serveurs Microsoft IIS 𝗜𝗻𝗰𝗶𝗱𝗲𝗻𝘁 𝗢𝗣𝗦𝗘𝗖 Directeur par intérim CISA : exfiltration involontaire documents classifiés via ChatGPT 𝗡𝗲𝘄𝘀𝗹𝗲𝘁𝘁𝗲𝗿 𝗰𝗼𝗺𝗽𝗹𝗲̀𝘁𝗲 𝗱𝗶𝘀𝗽𝗼𝗻𝗶𝗯𝗹𝗲 𝗶𝗰𝗶 : https://radiocsirt.substack.com/p/newsletter-radiocsirt-n47?r=57c3ye #Cybersecurity #ThreatIntelligence #CERT #CSIRT #InfoSec

ALERT: VMware vCenter RCE exploit (CVE-2024-37079) actively weaponized by threat actors. SOVEREIGN PROTOCOL: Immediate network segmentation of virtualization infrastructure, deploy dedicated management VLANs, implement zero-trust access controls. #TheSovereignProtocol

CISA says critical VMware RCE flaw now actively exploited Patched in June 2024, this security flaw (CVE-2024-37079) stems from a heap overflow weakness in the DCERPC protocol implementation of vCenter Server (a Broadcom VMware vSphere management platform that helps admins manage ESXi hosts and virtual machines). https://nuel.ink/vpXj0b

CISA confirms active exploitation of critical VMware vCenter RCE flaw CVE-2024-37079. Threat actors achieve remote code execution via crafted network packets. Sovereign Protocol: Immediately audit all virtualization infrastructure, implement network segmentation, deploy endpoint detection on hypervisor hosts, and establish air-gapped backup systems. Enterprise infrastructure compromise enables total data exfiltration and operational disruption. #TheSovereignProtocol