7.2 High

CVE-2024-22274 The vCenter Server contains an authenticated remote code execution vulnerability. A malicious actor with…

Description

The vCenter Server contains an authenticated remote code execution vulnerability. A malicious actor with administrative privileges on the vCenter appliance shell may exploit this issue to run arbitrary commands on the underlying operating system.

CVSS 3.1 detail

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitable remotely over the network, with an administrator account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector: Network
Attack complexity: Low
Privileges required: High
Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

Affected products and versions

Product	Affected versions	Fixed in
VMware vCenter Server 8.0	8.0 → latest	No fix stated
VMware vCenter Server 7.0	7.0 → latest	No fix stated
VMware Cloud Foundation (vCenter Server) 5	5.x → < 5.1.1	5.1.1
VMware Cloud Foundation (vCenter Server)	4.x	No fix stated
vmware_center_server	Versions not published

References

support.broadcom.com support.broadcom.com

Timeline

Published May 21, 2024
Last modified November 3, 2026

The 14 CVEs of VMware vCenter Server →

CVE-2024-38813 VMware vCenter Server Privilege Escalation Vulnerability 7.5 High CVE-2024-38812 VMware vCenter Server Heap-Based Buffer Overflow Vulnerability 9.8 Critical CVE-2024-37081 The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo. An… 7.8 High CVE-2024-37080 vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol 9.8 Critical

Track this CVE