Source: The Hacker News
Author: info@thehackernews.com (The Hacker News)
URL: https://thehackernews.com/2026/01/cisa-adds-actively-exploited-vmware.html
ONE SENTENCE SUMMARY:
CISA added a critical VMware vCenter Server security flaw to its KEV catalog due to active exploitation evidence.
MAIN POINTS:
- CISA listed VMware vCenter Server flaw CVE-2024-37079 as exploited.
- The flaw allows remote code execution via DCE/RPC protocol heap overflow.
- Broadcom patched CVE-2024-37079 and CVE-2024-37080 in June 2024.
- QiAnXin LegendSec researchers identified four related vulnerabilities.
- Two other flaws, CVE-2024-38812 and CVE-2024-38813, fixed in September 2024.
- One vulnerability can be combined with privilege escalation for root access.
- It’s unclear who exploits CVE-2024-37079 or the attack scale.
- Broadcom confirmed in-the-wild abuse of CVE-2024-37079.
- Agencies must update to the latest version by February 13, 2026.
- Security flaw poses serious risks to vCenter Server environments.
TAKEAWAYS:
- Keeping software updated is critical due to active exploitations.
- Awareness of vulnerability details can mitigate potential risks.
- Collaboration between companies and researchers improves security.
- Rapid response to patches reduces exposure to threats.
- Agencies should prioritize timely updates for optimal protection.