Vulnerability Intelligence Report
CVE-2024-37081
The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo. An authenticated local user with non-administrative privileges may exploit these issues to elevate privileges to root on vCenter Server Appliance.
No Active Exploit Signals
CVSS Base Score
7.8
HIGH
Exploitability:1.9
Impact Score:5.9
EPSS Probability:4.99%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-556 ↗CWE-556 ASP.NET Misconfiguration: Use of Identity Impersonation
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| n/a | VMware vCenter Server | 8.0 < 8.0 U2d (affected), 7.0 < 7.0 U3r (affected) |
| n/a | VMware Cloud Foundation | 5.x (affected), 4.x (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
4.989%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | VMware by Broadcom · Vendor · USA |
| Reserved | 2024-06-03T05:40:17 |
| Published | 2024-06-18T05:43:20 |
| Patch Date | 2024-06-17 |
| Last Updated | 2026-11-04T00:00:08 |
Community Chatter & Buzz