Code injection in VMware vCenter Server
Priority HIGH 67CWE-94Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-94.
Summary
The vCenter Server contains an authenticated remote code execution vulnerability. A malicious actor with administrative privileges on the vCenter appliance shell may exploit this issue to run arbitrary commands on the underlying operating system.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.02509 84th percentileScored 2026-11-07
Fix Fixed VMware vCenter Server: 8.0 U2b, 7.0 U3qVMware Cloud Foundation (vCenter Server): 5.1.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | VMware vCenter Server | 8.0 to before 8.0 U2b; 7.0 to before 7.0 U3q | 8.0 U2b, 7.0 U3q | Patch available | CNA |
| — | VMware Cloud Foundation (vCenter Server) | 5.x to before 5.1.1; 4.x | 5.1.1 | Patch available | CNA |
- VMware vCenter Server Vendor— Affected 8.0 to before 8.0 U2b; 7.0 to before 7.0 U3q Fixed in 8.0 U2b, 7.0 U3q Patch available CNA
- VMware Cloud Foundation (vCenter Server) Vendor— Affected 5.x to before 5.1.1; 4.x Fixed in 5.1.1 Patch available CNA
CPE configurations NVD · 43
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:* | 4.0 to before 5.1.1 | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:-:*:*:*:*:*:* | 7.0 | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:a:*:*:*:*:*:* | 7.0 a | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:b:*:*:*:*:*:* | 7.0 b | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:c:*:*:*:*:*:* | 7.0 c | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:d:*:*:*:*:*:* | 7.0 d | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update1:*:*:*:*:*:* | 7.0 update1 | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update1a:*:*:*:*:*:* | 7.0 update1a | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update1c:*:*:*:*:*:* | 7.0 update1c | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update1d:*:*:*:*:*:* | 7.0 update1d | Vulnerable | VMware |
- cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:* Versions 4.0 to before 5.1.1 Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:-:*:*:*:*:*:* Versions 7.0 Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:a:*:*:*:*:*:* Versions 7.0 a Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:b:*:*:*:*:*:* Versions 7.0 b Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:c:*:*:*:*:*:* Versions 7.0 c Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:d:*:*:*:*:*:* Versions 7.0 d Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update1:*:*:*:*:*:* Versions 7.0 update1 Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update1a:*:*:*:*:*:* Versions 7.0 update1a Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update1c:*:*:*:*:*:* Versions 7.0 update1c Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update1d:*:*:*:*:*:* Versions 7.0 update1d Vulnerable ·VMware
Show 33 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vmware:vcenter_server:7.0:update2:*:*:*:*:*:* | 7.0 update2 | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update2a:*:*:*:*:*:* | 7.0 update2a | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update2b:*:*:*:*:*:* | 7.0 update2b | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update2c:*:*:*:*:*:* | 7.0 update2c | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update2d:*:*:*:*:*:* | 7.0 update2d | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update3:*:*:*:*:*:* | 7.0 update3 | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update3a:*:*:*:*:*:* | 7.0 update3a | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update3c:*:*:*:*:*:* | 7.0 update3c | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update3d:*:*:*:*:*:* | 7.0 update3d | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update3e:*:*:*:*:*:* | 7.0 update3e | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update3f:*:*:*:*:*:* | 7.0 update3f | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update3g:*:*:*:*:*:* | 7.0 update3g | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update3h:*:*:*:*:*:* | 7.0 update3h | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update3i:*:*:*:*:*:* | 7.0 update3i | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update3j:*:*:*:*:*:* | 7.0 update3j | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update3k:*:*:*:*:*:* | 7.0 update3k | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update3l:*:*:*:*:*:* | 7.0 update3l | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update3m:*:*:*:*:*:* | 7.0 update3m | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update3n:*:*:*:*:*:* | 7.0 update3n | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update3o:*:*:*:*:*:* | 7.0 update3o | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update3p:*:*:*:*:*:* | 7.0 update3p | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:-:*:*:*:*:*:* | 8.0 | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:a:*:*:*:*:*:* | 8.0 a | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:b:*:*:*:*:*:* | 8.0 b | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:c:*:*:*:*:*:* | 8.0 c | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:update1:*:*:*:*:*:* | 8.0 update1 | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:update1a:*:*:*:*:*:* | 8.0 update1a | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:update1b:*:*:*:*:*:* | 8.0 update1b | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:update1c:*:*:*:*:*:* | 8.0 update1c | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:update1d:*:*:*:*:*:* | 8.0 update1d | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:update1e:*:*:*:*:*:* | 8.0 update1e | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:update2:*:*:*:*:*:* | 8.0 update2 | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:update2a:*:*:*:*:*:* | 8.0 update2a | Vulnerable | VMware |
- cpe:2.3:a:vmware:vcenter_server:7.0:update2:*:*:*:*:*:* Versions 7.0 update2 Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update2a:*:*:*:*:*:* Versions 7.0 update2a Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update2b:*:*:*:*:*:* Versions 7.0 update2b Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update2c:*:*:*:*:*:* Versions 7.0 update2c Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update2d:*:*:*:*:*:* Versions 7.0 update2d Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update3:*:*:*:*:*:* Versions 7.0 update3 Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update3a:*:*:*:*:*:* Versions 7.0 update3a Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update3c:*:*:*:*:*:* Versions 7.0 update3c Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update3d:*:*:*:*:*:* Versions 7.0 update3d Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update3e:*:*:*:*:*:* Versions 7.0 update3e Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update3f:*:*:*:*:*:* Versions 7.0 update3f Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update3g:*:*:*:*:*:* Versions 7.0 update3g Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update3h:*:*:*:*:*:* Versions 7.0 update3h Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update3i:*:*:*:*:*:* Versions 7.0 update3i Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update3j:*:*:*:*:*:* Versions 7.0 update3j Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update3k:*:*:*:*:*:* Versions 7.0 update3k Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update3l:*:*:*:*:*:* Versions 7.0 update3l Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update3m:*:*:*:*:*:* Versions 7.0 update3m Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update3n:*:*:*:*:*:* Versions 7.0 update3n Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update3o:*:*:*:*:*:* Versions 7.0 update3o Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update3p:*:*:*:*:*:* Versions 7.0 update3p Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:-:*:*:*:*:*:* Versions 8.0 Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:a:*:*:*:*:*:* Versions 8.0 a Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:b:*:*:*:*:*:* Versions 8.0 b Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:c:*:*:*:*:*:* Versions 8.0 c Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:update1:*:*:*:*:*:* Versions 8.0 update1 Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:update1a:*:*:*:*:*:* Versions 8.0 update1a Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:update1b:*:*:*:*:*:* Versions 8.0 update1b Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:update1c:*:*:*:*:*:* Versions 8.0 update1c Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:update1d:*:*:*:*:*:* Versions 8.0 update1d Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:update1e:*:*:*:*:*:* Versions 8.0 update1e Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:update2:*:*:*:*:*:* Versions 8.0 update2 Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:update2a:*:*:*:*:*:* Versions 8.0 update2a Vulnerable ·VMware
Remediation
- Fix · CNA VMware vCenter Server Fixed in 8.0 U2b, 7.0 U3q
- Fix · CNA VMware Cloud Foundation (vCenter Server) Fixed in 5.1.1
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
VMware Cloud Foundation (vCenter Server), VMware vCenter Server 5.1.1, 7.0 U3q, 8.0 U2b
2 records Highest priority Priority HIGH 1 HIGH, 1 LOW
Other records, highest priority first
- TI-2024-14862 Information disclosure in VMware vCenter ServerPriority LOW 24
Timeline
- 2026-10-02 Threatist record created from CVE-2024-22274
- 2026-10-03 Alias added: GHSA-xm44-79f8-q8r7
- 2026-11-03 CISA SSVC decision points changed
References
More VMware Cloud Foundation vulnerabilities
- TI-2024-26040 Privilege escalation in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
- TI-2024-26039 Heap-overflow in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
- TI-2024-24610 Out-of-bounds write in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
- TI-2022-07131 Code injection in VMware Workspace ONE Access and Identity Manager KEVCVSS 3.1CRITICAL 9.8
- TI-2021-05049 Path traversal in VMware vCenter Server, VMware Cloud Foundation KEVCVSS 3.1CRITICAL 9.8
- TI-2021-05029 Improper input validation in VMware vCenter Server and VMware Cloud Foundation KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2024-22274 · CVE Program
- CVE-2024-22274 · NVD
- FIRST EPSS
- GHSA-xm44-79f8-q8r7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences