The vCenter Server contains multiple local privilege escalation vulnerabilities due to…
Priority HIGH 69CWE-556Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo. An authenticated local user with non-administrative privileges may exploit these issues to elevate privileges to root on vCenter Server Appliance.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.04989 92nd percentileScored 2026-11-07
Fix Fixed VMware vCenter Server: 8.0 U2d, 7.0 U3r
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | VMware vCenter Server | 8.0 to before 8.0 U2d; 7.0 to before 7.0 U3r | 8.0 U2d, 7.0 U3r | Patch available | CNA |
| — | VMware Cloud Foundation | 5.x; 4.x | — | No fix listed | CNA |
- VMware vCenter Server Vendor— Affected 8.0 to before 8.0 U2d; 7.0 to before 7.0 U3r Fixed in 8.0 U2d, 7.0 U3r Patch available CNA
- VMware Cloud Foundation Vendor— Affected 5.x; 4.x Fixed in — No fix listed CNA
CPE configurations NVD · 46
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vmware:vcenter_server:8.0:-:*:*:*:*:*:* | 8.0 | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:a:*:*:*:*:*:* | 8.0 a | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:b:*:*:*:*:*:* | 8.0 b | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:c:*:*:*:*:*:* | 8.0 c | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:update1:*:*:*:*:*:* | 8.0 update1 | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:update1a:*:*:*:*:*:* | 8.0 update1a | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:update1b:*:*:*:*:*:* | 8.0 update1b | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:update1c:*:*:*:*:*:* | 8.0 update1c | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:update1d:*:*:*:*:*:* | 8.0 update1d | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:update1e:*:*:*:*:*:* | 8.0 update1e | Vulnerable | VMware |
- cpe:2.3:a:vmware:vcenter_server:8.0:-:*:*:*:*:*:* Versions 8.0 Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:a:*:*:*:*:*:* Versions 8.0 a Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:b:*:*:*:*:*:* Versions 8.0 b Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:c:*:*:*:*:*:* Versions 8.0 c Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:update1:*:*:*:*:*:* Versions 8.0 update1 Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:update1a:*:*:*:*:*:* Versions 8.0 update1a Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:update1b:*:*:*:*:*:* Versions 8.0 update1b Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:update1c:*:*:*:*:*:* Versions 8.0 update1c Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:update1d:*:*:*:*:*:* Versions 8.0 update1d Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:update1e:*:*:*:*:*:* Versions 8.0 update1e Vulnerable ·VMware
Show 36 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vmware:vcenter_server:8.0:update2:*:*:*:*:*:* | 8.0 update2 | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:update2a:*:*:*:*:*:* | 8.0 update2a | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:update2b:*:*:*:*:*:* | 8.0 update2b | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:update2c:*:*:*:*:*:* | 8.0 update2c | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:-:*:*:*:*:*:* | 7.0 | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:a:*:*:*:*:*:* | 7.0 a | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:b:*:*:*:*:*:* | 7.0 b | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:c:*:*:*:*:*:* | 7.0 c | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:d:*:*:*:*:*:* | 7.0 d | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update1:*:*:*:*:*:* | 7.0 update1 | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update1a:*:*:*:*:*:* | 7.0 update1a | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update1c:*:*:*:*:*:* | 7.0 update1c | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update1d:*:*:*:*:*:* | 7.0 update1d | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update2:*:*:*:*:*:* | 7.0 update2 | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update2a:*:*:*:*:*:* | 7.0 update2a | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update2b:*:*:*:*:*:* | 7.0 update2b | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update2c:*:*:*:*:*:* | 7.0 update2c | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update2d:*:*:*:*:*:* | 7.0 update2d | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update3:*:*:*:*:*:* | 7.0 update3 | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update3a:*:*:*:*:*:* | 7.0 update3a | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update3c:*:*:*:*:*:* | 7.0 update3c | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update3d:*:*:*:*:*:* | 7.0 update3d | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update3e:*:*:*:*:*:* | 7.0 update3e | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update3f:*:*:*:*:*:* | 7.0 update3f | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update3g:*:*:*:*:*:* | 7.0 update3g | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update3h:*:*:*:*:*:* | 7.0 update3h | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update3i:*:*:*:*:*:* | 7.0 update3i | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update3j:*:*:*:*:*:* | 7.0 update3j | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update3k:*:*:*:*:*:* | 7.0 update3k | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update3l:*:*:*:*:*:* | 7.0 update3l | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update3m:*:*:*:*:*:* | 7.0 update3m | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update3n:*:*:*:*:*:* | 7.0 update3n | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update3o:*:*:*:*:*:* | 7.0 update3o | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update3p:*:*:*:*:*:* | 7.0 update3p | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update3q:*:*:*:*:*:* | 7.0 update3q | Vulnerable | VMware |
| cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:* | 4.0 to before 5.2 | Vulnerable | VMware |
- cpe:2.3:a:vmware:vcenter_server:8.0:update2:*:*:*:*:*:* Versions 8.0 update2 Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:update2a:*:*:*:*:*:* Versions 8.0 update2a Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:update2b:*:*:*:*:*:* Versions 8.0 update2b Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:update2c:*:*:*:*:*:* Versions 8.0 update2c Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:-:*:*:*:*:*:* Versions 7.0 Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:a:*:*:*:*:*:* Versions 7.0 a Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:b:*:*:*:*:*:* Versions 7.0 b Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:c:*:*:*:*:*:* Versions 7.0 c Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:d:*:*:*:*:*:* Versions 7.0 d Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update1:*:*:*:*:*:* Versions 7.0 update1 Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update1a:*:*:*:*:*:* Versions 7.0 update1a Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update1c:*:*:*:*:*:* Versions 7.0 update1c Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update1d:*:*:*:*:*:* Versions 7.0 update1d Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update2:*:*:*:*:*:* Versions 7.0 update2 Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update2a:*:*:*:*:*:* Versions 7.0 update2a Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update2b:*:*:*:*:*:* Versions 7.0 update2b Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update2c:*:*:*:*:*:* Versions 7.0 update2c Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update2d:*:*:*:*:*:* Versions 7.0 update2d Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update3:*:*:*:*:*:* Versions 7.0 update3 Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update3a:*:*:*:*:*:* Versions 7.0 update3a Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update3c:*:*:*:*:*:* Versions 7.0 update3c Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update3d:*:*:*:*:*:* Versions 7.0 update3d Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update3e:*:*:*:*:*:* Versions 7.0 update3e Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update3f:*:*:*:*:*:* Versions 7.0 update3f Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update3g:*:*:*:*:*:* Versions 7.0 update3g Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update3h:*:*:*:*:*:* Versions 7.0 update3h Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update3i:*:*:*:*:*:* Versions 7.0 update3i Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update3j:*:*:*:*:*:* Versions 7.0 update3j Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update3k:*:*:*:*:*:* Versions 7.0 update3k Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update3l:*:*:*:*:*:* Versions 7.0 update3l Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update3m:*:*:*:*:*:* Versions 7.0 update3m Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update3n:*:*:*:*:*:* Versions 7.0 update3n Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update3o:*:*:*:*:*:* Versions 7.0 update3o Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update3p:*:*:*:*:*:* Versions 7.0 update3p Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update3q:*:*:*:*:*:* Versions 7.0 update3q Vulnerable ·VMware
- cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:* Versions 4.0 to before 5.2 Vulnerable ·VMware
Remediation
- Fix · CNA VMware vCenter Server Fixed in 8.0 U2d, 7.0 U3r
Timeline
- 2026-10-02 Threatist record created from CVE-2024-37081
- 2026-10-03 Alias added: GHSA-rhv4-3chh-r5jc
- 2026-11-03 CISA SSVC decision points changed
References
More VMware Cloud Foundation vulnerabilities
- TI-2024-26040 Privilege escalation in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
- TI-2024-26039 Heap-overflow in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
- TI-2024-24610 Out-of-bounds write in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
- TI-2022-07131 Code injection in VMware Workspace ONE Access and Identity Manager KEVCVSS 3.1CRITICAL 9.8
- TI-2021-05049 Path traversal in VMware vCenter Server, VMware Cloud Foundation KEVCVSS 3.1CRITICAL 9.8
- TI-2021-05029 Improper input validation in VMware vCenter Server and VMware Cloud Foundation KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2024-37081 · CVE Program
- CVE-2024-37081 · NVD
- FIRST EPSS
- GHSA-rhv4-3chh-r5jc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences