CVE-2023-34048
VMware vCenter Server Out-of-Bounds Write Vulnerability
Published Oct 25, 2023 · updated Jun 16, 2026 · vmware vcenter server
vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds write potentially leading to remote code execution.
Timeline
Detection, updates, and resolution for this record.
Oct 25, 2023 · Catalog
Detected
vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds write potentially leading to remote code execution.
Jan 22, 2024 · CISA KEV
Known exploited
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Feb 12, 2024 · CISA KEV
Remediation due
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Jun 16, 2026 · Catalog
Updated
vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds write potentially leading to remote code execution.
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA due date Feb 12, 2024
Affected
- cpe vmware/vcenter serverversion unspecified
- cpe vmware/vcenter server7.0
- vendor VMware vCenter Serverversion unspecified
Sources
- CISA KEVCVE-2023-34048
VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol that allows an attacker to conduct remote code execution.
cisa.gov - CVE.orgCVE-2023-34048
Official CVE identifier
cve.org - FIRST EPSSCVE-2023-34048
30-day exploitation probability 99.4%
first.org - NIST NVDCVE-2023-34048
vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds write potentially leading to remote code execution.
nvd.nist.gov