VMware vCenter Server code-execution flaw CVE-2024-37079 used in attacks; fixes available
Attackers have exploited CVE-2024-37079 in VMware vCenter Server, software used to manage business virtual servers. Fixes have existed since June 2024. Ask your IT provider to verify vCenter and Cloud Foundation are patched.
Nothing for you to do on ordinary family phones or computers: this affects business server management. If your business or family office runs VMware, ask its IT provider to confirm vCenter is on a supported release containing the fixes in 8.0 U2d, 8.0 U1e or 7.0 U3r; Cloud Foundation administrators should follow Broadcom’s KB88287 patch guidance.
What’s happening
CVE-2024-37079 affects VMware vCenter Server, the management software organisations use for virtual servers, including deployments within VMware Cloud Foundation. A network-reachable attacker can potentially run code without signing in or needing someone to click anything. VMware released patches in June 2024. On 23 January 2026, CISA listed the flaw as exploited and Broadcom revised its advisory to acknowledge evidence of attacks. Cloud Foundation administrators have a vendor-supported patch route through Broadcom’s Async Patch guidance. As of 3 November 2026, fixes remain available; the reviewed sources do not establish when attacks began, who carried them out, how many organisations were affected or whether attacks have stopped.
- What
- Flaw
- Affects
- VMware vCenter Server and VMware Cloud Foundation
- Affected
- VMware vCenter Server 8.0 Update 2 branch before 8.0 U2d
VMware vCenter Server 8.0 Update 1 branch before 8.0 U1e
VMware vCenter Server 7.0 before 7.0 U3r
VMware Cloud Foundation 5.x and 4.x containing affected vCenter Server - Fixed in
- VMware vCenter Server 8.0 U2d
VMware vCenter Server 8.0 U1e
VMware vCenter Server 7.0 U3r
VMware Cloud Foundation 5.x and 4.x: applicable vCenter Server updates through KB88287 - Since
- 23 Jan 2026
- Closed
- 24 Jan 2026
Timeline
- Update
Reporting on the exploitation warning said the attackers, method of exploitation and scale of attacks were unknown.
- Vendor revised
Broadcom revised its advisory to report information suggesting CVE-2024-37079 had been exploited. The revision retained the existing fixes.
- CISA added
CISA added CVE-2024-37079 to its Known Exploited Vulnerabilities catalogue, with a 13 February remediation deadline for US federal civilian agencies.
- New fixFixed
VMware disclosed CVE-2024-37079 and released vCenter Server fixes in 8.0 U2d, 8.0 U1e and 7.0 U3r. Cloud Foundation deployments also received a patch route.
Sources
- VMSA-2024-0012.1: VMware vCenter Server security updatesBroadcom · 23 Jan 2026
- VMSA-2024-0012: Questions & AnswersVMware · 17 June 2024
- Applying individual product updates to VMware Cloud Foundation environments using Async PatchBroadcom
- CISA says critical VMware RCE flaw now actively exploitedBleepingComputer · 26 Jan 2026
- CISA Adds Actively Exploited VMware vCenter Flaw CVE-2024-37079 to KEV CatalogThe Hacker News · 24 Jan 2026