Critical RCE bug in VMware vCenter Server now exploited in attacks

Broadcom confirms active exploitation of two VMware vCenter vulnerabilities—a remote code execution flaw due to a heap overflow in the DCE/RPC protocol (CVE-2024-38812) and a privilege escalation flaw (CVE-2024-38813)—urging immediate application of new security patches, especially as the initial fixes proved incomplete, with heightened vulnerabilities impacting VMware vSphere and Cloud Foundation users, all while providing detailed deployment guidance and context of ongoing targeting by sophisticated threat actors.