CVE-2024-37079
Out-of-bounds Write in Broadcom VMware vCenter Server. CISA confirmed attackers exploit it and added it to its Known Exploited Vulnerabilities catalog on 23 January 2026.
- Product
- Broadcom VMware vCenter Server
- Added to CISA's catalog
- Federal fix-by date
- Ransomware
- No known use in ransomware campaigns
- Vendor advisories
- Sources
- CISA’s catalog, NVD entry
CISA’s description.
Broadcom VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. This could allow a malicious actor with network access to vCenter Server to send specially crafted network packets, potentially leading to remote code execution.
More from Broadcom this year.
- CVE-2026-41709 Insufficient Logging, added
- CVE-2026-59310 Path Traversal, added
- CVE-2026-22719 Command Injection, added
Every flaw CISA confirmed exploited in the last 30 days is on the exploit watch. This is not security advice. Check the vendor’s advisory before acting. From CISA’s catalog of 4 November 2026.