// tag

vCenter

Security incidents tagged vCenter. Newest first.

## 1 vCenter incident in the last 12 months

crit 4 · high 3 · med 2 · low 1 · upd ½severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½lessmore

show 4 older incidents

Aug 18highBroadcom VMware vCenter: Broadcom VMware vCenter Path Traversal Vulnerabilitypatched
› Broadcom VMware vCenter patched
Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code. Added to CISA KEV on 2026-08-18.
open incident →CVE-2026-59310

Sep 17criticalVMware vCenter Server: 2 actively exploited vulnerabilitiespatched
› VMware vCenter Server patched
CVE-2024-38812: VMware vCenter Server contains a heap-based buffer overflow vulnerability in the implementation of the DCERPC protocol. This vulnerability could allow an attacker with network access to the vCenter Server to execute remote code by sending a specially crafted packet. CVE-2024-38813: VMware vCenter contains an improper check for dropped privileges vulnerability. This vulnerability could allow an attacker with network access to the vCenter Server to escalate privileges to root by sending a specially crafted packet. Added to the CISA KEV catalog on 2024-11-20.
open incident →CVE-2024-38812 · CVE-2024-38813

Jul 17mediumVMware vCenter Server Incorrect Default File Permissionspatched
› VMware vCenter Server patched
VMware vCenter Server contains an incorrect default file permissions vulnerability that allows a remote, privileged attacker to gain access to sensitive information. Added to the CISA KEV catalog on 2024-07-17. CVE-2022-22948 was assigned before 2024; the KEV listing came in 2024.
open incident →CVE-2022-22948

Jan 22criticalVMware vCenter Server Out-of-Bounds Writepatched
› VMware vCenter Server patched
VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol that allows an attacker to conduct remote code execution. Added to the CISA KEV catalog on 2024-01-22. CVE-2023-34048 was assigned before 2024; the KEV listing came in 2024.
open incident →CVE-2023-34048