CVE-2024-37080: vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may…

PriorityP270critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

12.48%

95.8th percentile

vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
vmware	vcenter_server	—	—
vmware	vcenter_server	—	—

Detection & IOCsextracted from sources · hover to see the quote

→CVE-2024-37080 is a heap-overflow vulnerability in VMware vCenter Server's DCERPC protocol implementation; detection should focus on anomalous or specially crafted DCERPC network packets sent to vCenter Server ↗
→Affected versions are VMware vCenter Server 7.0 and 8.0; prioritize monitoring and patching these versions ↗

·CVE-2024-37080 is grouped with CVE-2024-37079 (heap-overflow) and CVE-2024-37081 (local privilege escalation) in the same vCenter Server advisory; ensure detections and patches address all three CVEs together ↗

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.