The vCenter Server contains a privilege escalation vulnerability. A malicious actor with network access to vCenter Server may trigger this vulnerability to escalate privileges to root by sending a specially crafted network packet.
Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 20 Nov 2024.
Severity
Critical 9.8
Published
17 Sept 2024
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Sources
NVD
Affected software
Software
Affected versions
VMware vCenter ServerServers and applications · cpe:a:vmware:vcenter_server
Version 8.0-update2d
Version 8.0-update2
Version 8.0-update1e
Version 8.0-update1d
All 48 release lines
Version 7.0-a
Version 7.0-b
Version 7.0-c
Version 7.0-update1a
Version 7.0-update1c
Version 7.0-update2a
Version 7.0-update2b
Version 7.0-update2c
Version 7.0-update3a
Version 7.0-update3c
Version 7.0
Version 7.0-d
Version 7.0-update1
Version 7.0-update1d
Version 7.0-update2
Version 7.0-update2d
Version 7.0-update3
Version 7.0-update3d
Version 7.0-update3e
Version 7.0-update3f
Version 7.0-update3g
Version 7.0-update3h
Version 7.0-update3i
Version 7.0-update3j
Version 7.0-update3k
Version 7.0-update3l
Version 7.0-update3m
Version 7.0-update3n
Version 7.0-update3o
Version 7.0-update3p
Version 7.0-update3q
Version 7.0-update3r
Version 7.0-update3s
Version 8.0-a
Version 8.0-b
Version 8.0-c
Version 8.0-update1a
Version 8.0-update1b
Version 8.0-update1c
Version 8.0-update2a
Version 8.0-update2b
Version 8.0-update2c
Version 8.0
Version 8.0-update1
Version 8.0-update1d
Version 8.0-update1e
Version 8.0-update2
Version 8.0-update2d
Known exploited
CISA name
VMware vCenter Server Privilege Escalation Vulnerability
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.