CVE-2024-38813

Timeline

Detection, updates, and resolution for this record.

1. Sep 17, 2024 · Catalog

   Detected

   VMware vCenter contains an improper check for dropped privileges vulnerability. This vulnerability could allow an attacker with network access to the vCenter Server to escalate privileges to root by sending a specially crafted packet.

2. Nov 20, 2024 · CISA KEV

   Known exploited

   Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

3. Dec 11, 2024 · CISA KEV

   Remediation due

   Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

4. Jun 17, 2026 · Catalog

   Updated

   VMware vCenter contains an improper check for dropped privileges vulnerability. This vulnerability could allow an attacker with network access to the vCenter Server to escalate privileges to root by sending a specially crafted packet.

Affected

• cpe vmware/cloud foundationversion unspecified
• cpe vmware/vcenter server7.0
• cpe vmware/vcenter server8.0
• vendor VMware vCenter Serverversion unspecified

Sources

• CISA KEVCVE-2024-38813

  VMware vCenter contains an improper check for dropped privileges vulnerability. This vulnerability could allow an attacker with network access to the vCenter Server to escalate privileges to root by sending a specially crafted packet.

  cisa.gov
• CVE.orgCVE-2024-38813

  Official CVE identifier

  cve.org
• FIRST EPSSCVE-2024-38813

  30-day exploitation probability 17.4%

  first.org
• NIST NVDCVE-2024-38813

  The vCenter Server contains a privilege escalation vulnerability. A malicious actor with network access to vCenter Server may trigger this vulnerability to escalate privileges to root by sending a specially crafted network packet.

  nvd.nist.gov

References

• CISA note · nvd.nist.gov
• CISA note · support.broadcom.com
• US Government Resource · cisa.gov