Vulnerability Intelligence Report
CVE-2024-22274
The vCenter Server contains an authenticated remote code execution vulnerability. A malicious actor with administrative privileges on the vCenter appliance shell may exploit this issue to run arbitrary commands on the underlying operating system.
No Active Exploit Signals
CVSS Base Score
7.2
HIGH
Exploitability:1.3
Impact Score:5.9
EPSS Probability:2.51%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-94 ↗CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| n/a | VMware vCenter Server | 8.0 < 8.0 U2b (affected), 7.0 < 7.0 U3q (affected) |
| n/a | VMware Cloud Foundation (vCenter Server) | 5.x < 5.1.1 (affected), 4.x (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
2.509%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | VMware by Broadcom · Vendor · USA |
| Reserved | 2024-01-08T18:43:18 |
| Published | 2024-05-21T17:29:33 |
| Last Updated | 2026-11-03T23:53:09 |
Community Chatter & Buzz