PT-2024-15284 · Vmware · Vsphere Client+1

Published

2024-11-21

·

Updated

2026-04-17

·

CVE-2024-0000

None

No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions VMware vCenter Server versions prior to the latest patch release
Description A critical security issue in VMware vCenter Server allows attackers to execute remote code on affected systems. This flaw is being actively exploited by cybercriminals, posing a severe threat to organizations running VMware environments. The issue resides in the vSphere Client component of vCenter Server and can be exploited by unauthenticated attackers, potentially giving them full control over vulnerable servers and allowing them to execute arbitrary commands. The vulnerability is classified as critical due to its ease of exploitation. Security experts urge immediate action to mitigate the risk, as successful exploits have already been reported. The issue could have devastating consequences for businesses, including unauthorized access to sensitive data, complete compromise of virtual machines and workloads, ransomware attacks, and loss of critical business continuity.
Recommendations To address the issue in VMware vCenter Server versions prior to the latest patch release, patch the software immediately to the latest release provided by VMware, ensuring updates are applied to all affected systems. As a temporary workaround, consider monitoring for unusual activity on vCenter Server instances, including any unexplained access or unauthorized actions, until the patch is applied. Implement network segmentation to limit the exposure of vCenter Server and reduce potential attack vectors. Review security best practices for vCenter Server configurations and permissions to prevent further exploitation.

Related Identifiers

CVE-2024-0000

Affected Products

Vmware Vcenter Server
Vsphere Client