pwn.watch: vCenter incident updates

[high] Broadcom VMware vCenter: Broadcom VMware vCenter Path Traversal Vulnerability

Tue, 18 Aug 2026 00:00:00 GMT

Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code. Added to CISA KEV on 2026-08-18.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-08-18: CISA added CVE-2026-59310 to the KEV catalog (due 2026-08-21).

CVEs: CVE-2026-59310

[critical] VMware vCenter Server: 2 actively exploited vulnerabilities

Wed, 20 Nov 2024 00:00:00 GMT

CVE-2024-38812: VMware vCenter Server contains a heap-based buffer overflow vulnerability in the implementation of the DCERPC protocol. This vulnerability could allow an attacker with network access to the vCenter Server to execute remote code by sending a specially crafted packet. CVE-2024-38813: VMware vCenter contains an improper check for dropped privileges vulnerability. This vulnerability could allow an attacker with network access to the vCenter Server to escalate privileges to root by sending a specially crafted packet. Added to the CISA KEV catalog on 2024-11-20.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-11-20: CISA added CVE-2024-38812 to the KEV catalog (federal deadline 2024-12-11) (source)
2024-11-20: CISA added CVE-2024-38813 to the KEV catalog (federal deadline 2024-12-11) (source)
2024-09-17: CVE-2024-38812 published (source)

CVEs: CVE-2024-38812, CVE-2024-38813

[medium] VMware vCenter Server Incorrect Default File Permissions

Wed, 17 Jul 2024 00:00:00 GMT

VMware vCenter Server contains an incorrect default file permissions vulnerability that allows a remote, privileged attacker to gain access to sensitive information. Added to the CISA KEV catalog on 2024-07-17. CVE-2022-22948 was assigned before 2024; the KEV listing came in 2024.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-07-17: CISA added CVE-2022-22948 to the KEV catalog (federal deadline 2024-08-07) (source)

CVEs: CVE-2022-22948

[critical] VMware vCenter Server Out-of-Bounds Write

Mon, 22 Jan 2024 00:00:00 GMT

VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol that allows an attacker to conduct remote code execution. Added to the CISA KEV catalog on 2024-01-22. CVE-2023-34048 was assigned before 2024; the KEV listing came in 2024.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-01-22: CISA added CVE-2023-34048 to the KEV catalog (federal deadline 2024-02-12) (source)

CVEs: CVE-2023-34048