Read the docs
TI-2024-26040 Aliases CVE-2024-38813GHSA-66vj-hxh5-x3jh

Privilege escalation in VMware vCenter Server

Priority CRITICAL 100Exploited in the wildCWE-250Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-250.

Summary

The vCenter Server contains a privilege escalation vulnerability. A malicious actor with network access to vCenter Server may trigger this vulnerability to escalate privileges to root by sending a specially crafted network packet.

Why it matters now

Exploitation Active In CISA KEV since 2024-11-20CISA due date 2024-12-11
EPSS 0.17355 97th percentileScored 2026-11-07
Fix Fixed VMware vCenter Server: 8.0 U3b, 7.0 U3s

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—VMware vCenter Server8.0 to before 8.0 U3b; 7.0 to before 7.0 U3s8.0 U3b, 7.0 U3sPatch availableCNA
—VMware Cloud Foundation5.x; 4.x—No fix listedCNA
  • VMware vCenter Server Vendor— Affected 8.0 to before 8.0 U3b; 7.0 to before 7.0 U3s Fixed in 8.0 U3b, 7.0 U3s Patch available CNA
  • VMware Cloud Foundation Vendor— Affected 5.x; 4.x Fixed in — No fix listed CNA

CPE configurations NVD · 49

CPEVersionsRoleVendor
cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*4.0 to before 5.2VulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:-:*:*:*:*:*:*7.0VulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:a:*:*:*:*:*:*7.0 aVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:b:*:*:*:*:*:*7.0 bVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:c:*:*:*:*:*:*7.0 cVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:d:*:*:*:*:*:*7.0 dVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update1:*:*:*:*:*:*7.0 update1VulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update1a:*:*:*:*:*:*7.0 update1aVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update1c:*:*:*:*:*:*7.0 update1cVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update1d:*:*:*:*:*:*7.0 update1dVulnerableVMware
  • cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:* Versions 4.0 to before 5.2 Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:-:*:*:*:*:*:* Versions 7.0 Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:a:*:*:*:*:*:* Versions 7.0 a Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:b:*:*:*:*:*:* Versions 7.0 b Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:c:*:*:*:*:*:* Versions 7.0 c Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:d:*:*:*:*:*:* Versions 7.0 d Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update1:*:*:*:*:*:* Versions 7.0 update1 Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update1a:*:*:*:*:*:* Versions 7.0 update1a Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update1c:*:*:*:*:*:* Versions 7.0 update1c Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update1d:*:*:*:*:*:* Versions 7.0 update1d Vulnerable ·VMware
Show 39 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:vmware:vcenter_server:7.0:update2:*:*:*:*:*:*7.0 update2VulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update2a:*:*:*:*:*:*7.0 update2aVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update2b:*:*:*:*:*:*7.0 update2bVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update2c:*:*:*:*:*:*7.0 update2cVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update2d:*:*:*:*:*:*7.0 update2dVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update3:*:*:*:*:*:*7.0 update3VulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update3a:*:*:*:*:*:*7.0 update3aVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update3c:*:*:*:*:*:*7.0 update3cVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update3d:*:*:*:*:*:*7.0 update3dVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update3e:*:*:*:*:*:*7.0 update3eVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update3f:*:*:*:*:*:*7.0 update3fVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update3g:*:*:*:*:*:*7.0 update3gVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update3h:*:*:*:*:*:*7.0 update3hVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update3i:*:*:*:*:*:*7.0 update3iVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update3j:*:*:*:*:*:*7.0 update3jVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update3k:*:*:*:*:*:*7.0 update3kVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update3l:*:*:*:*:*:*7.0 update3lVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update3m:*:*:*:*:*:*7.0 update3mVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update3n:*:*:*:*:*:*7.0 update3nVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update3o:*:*:*:*:*:*7.0 update3oVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update3p:*:*:*:*:*:*7.0 update3pVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update3q:*:*:*:*:*:*7.0 update3qVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update3r:*:*:*:*:*:*7.0 update3rVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:7.0:update3s:*:*:*:*:*:*7.0 update3sVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:8.0:-:*:*:*:*:*:*8.0VulnerableVMware
cpe:2.3:a:vmware:vcenter_server:8.0:a:*:*:*:*:*:*8.0 aVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:8.0:b:*:*:*:*:*:*8.0 bVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:8.0:c:*:*:*:*:*:*8.0 cVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:8.0:update1:*:*:*:*:*:*8.0 update1VulnerableVMware
cpe:2.3:a:vmware:vcenter_server:8.0:update1a:*:*:*:*:*:*8.0 update1aVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:8.0:update1b:*:*:*:*:*:*8.0 update1bVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:8.0:update1c:*:*:*:*:*:*8.0 update1cVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:8.0:update1d:*:*:*:*:*:*8.0 update1dVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:8.0:update1e:*:*:*:*:*:*8.0 update1eVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:8.0:update2:*:*:*:*:*:*8.0 update2VulnerableVMware
cpe:2.3:a:vmware:vcenter_server:8.0:update2a:*:*:*:*:*:*8.0 update2aVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:8.0:update2b:*:*:*:*:*:*8.0 update2bVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:8.0:update2c:*:*:*:*:*:*8.0 update2cVulnerableVMware
cpe:2.3:a:vmware:vcenter_server:8.0:update2d:*:*:*:*:*:*8.0 update2dVulnerableVMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update2:*:*:*:*:*:* Versions 7.0 update2 Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update2a:*:*:*:*:*:* Versions 7.0 update2a Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update2b:*:*:*:*:*:* Versions 7.0 update2b Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update2c:*:*:*:*:*:* Versions 7.0 update2c Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update2d:*:*:*:*:*:* Versions 7.0 update2d Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update3:*:*:*:*:*:* Versions 7.0 update3 Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update3a:*:*:*:*:*:* Versions 7.0 update3a Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update3c:*:*:*:*:*:* Versions 7.0 update3c Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update3d:*:*:*:*:*:* Versions 7.0 update3d Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update3e:*:*:*:*:*:* Versions 7.0 update3e Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update3f:*:*:*:*:*:* Versions 7.0 update3f Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update3g:*:*:*:*:*:* Versions 7.0 update3g Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update3h:*:*:*:*:*:* Versions 7.0 update3h Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update3i:*:*:*:*:*:* Versions 7.0 update3i Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update3j:*:*:*:*:*:* Versions 7.0 update3j Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update3k:*:*:*:*:*:* Versions 7.0 update3k Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update3l:*:*:*:*:*:* Versions 7.0 update3l Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update3m:*:*:*:*:*:* Versions 7.0 update3m Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update3n:*:*:*:*:*:* Versions 7.0 update3n Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update3o:*:*:*:*:*:* Versions 7.0 update3o Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update3p:*:*:*:*:*:* Versions 7.0 update3p Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update3q:*:*:*:*:*:* Versions 7.0 update3q Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update3r:*:*:*:*:*:* Versions 7.0 update3r Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:7.0:update3s:*:*:*:*:*:* Versions 7.0 update3s Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:8.0:-:*:*:*:*:*:* Versions 8.0 Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:8.0:a:*:*:*:*:*:* Versions 8.0 a Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:8.0:b:*:*:*:*:*:* Versions 8.0 b Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:8.0:c:*:*:*:*:*:* Versions 8.0 c Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:8.0:update1:*:*:*:*:*:* Versions 8.0 update1 Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:8.0:update1a:*:*:*:*:*:* Versions 8.0 update1a Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:8.0:update1b:*:*:*:*:*:* Versions 8.0 update1b Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:8.0:update1c:*:*:*:*:*:* Versions 8.0 update1c Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:8.0:update1d:*:*:*:*:*:* Versions 8.0 update1d Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:8.0:update1e:*:*:*:*:*:* Versions 8.0 update1e Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:8.0:update2:*:*:*:*:*:* Versions 8.0 update2 Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:8.0:update2a:*:*:*:*:*:* Versions 8.0 update2a Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:8.0:update2b:*:*:*:*:*:* Versions 8.0 update2b Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:8.0:update2c:*:*:*:*:*:* Versions 8.0 update2c Vulnerable ·VMware
  • cpe:2.3:a:vmware:vcenter_server:8.0:update2d:*:*:*:*:*:* Versions 8.0 update2d Vulnerable ·VMware

Remediation

  • Fix · CNA VMware vCenter Server Fixed in 8.0 U3b, 7.0 U3s

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    VMware vCenter Server 7.0 U3s, 8.0 U3b

    2 records Highest priority Priority CRITICAL 2 CRITICAL

    Other records, highest priority first

    • TI-2024-26039 Heap-overflow in VMware vCenter ServerPriority CRITICAL 100
    Show all 2 records →

Timeline

  1. 2024-11-20 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2024-38813
  3. 2026-10-03 Alias added: GHSA-66vj-hxh5-x3jh

References

Advisory 1

  • TI-2024-26039 Heap-overflow in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-24610 Out-of-bounds write in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-07131 Code injection in VMware Workspace ONE Access and Identity Manager KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-05049 Path traversal in VMware vCenter Server, VMware Cloud Foundation KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-05029 Improper input validation in VMware vCenter Server and VMware Cloud Foundation KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-05020 Server-side request forgery in VMware vRealize Operations KEVCVSS 3.1CRITICAL 9.8
See all 134 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences