Hazard

Is CVE-2024-38812 being exploited?

Weaponised and widely attempted

Reliable public exploit code exists, or mass exploitation attempts are probable. Patch inside days, not weeks.

VMware vCenter Server Heap-Based Buffer Overflow Vulnerability

VMware · vCenter Server

CVSS 9.8 EPSS 54% no public exploit indexed Fix deadline passed 11 December 2024

What it is

VMware vCenter Server contains a heap-based buffer overflow vulnerability in the implementation of the DCERPC protocol. This vulnerability could allow an attacker with network access to the vCenter Server to execute remote code by sending a specially crafted packet.

Why we say that

  • EPSS puts exploitation in the next 30 days at 54%
  • CISA's federal remediation deadline (2024-12-11) has passed
  • CVSS 9.8 critical
  • Listed in the CISA Known Exploited Vulnerabilities catalogue

Every line above comes from a named public source. Where the evidence is thin, we say so rather than inventing confidence — see methodology.

What to do

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

What it costs when this goes wrong

This is where UK enforcement meets the vulnerability record. Where an unfixed vulnerability leads to a breach, the ICO treats it as a security failure under UK GDPR. Recent cases:

All UK cases caused by unpatched software →