Critical VMware vCenter Vulnerability Added to CISA’s Exploited Flaws Catalog The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2024-37079, a critical vulnerability in Broadcom’s VMware vCenter Server, to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation in the wild. The flaw, disclosed by Broadcom, is an out-of-bounds write issue in the DCERPC protocol implementation, allowing unauthenticated attackers with network access to execute remote code and potentially gain full control of affected systems. As the centralized management platform for VMware vSphere environments, a compromised vCenter Server could enable lateral movement across virtualized infrastructure, making this a high-risk threat for enterprises. The vulnerability (CWE-787) requires no user interaction, increasing its appeal to initial access brokers and ransomware groups, though CISA has not yet confirmed its use in ransomware campaigns. CISA’s addition of the flaw to the KEV catalog on January 23, 2026, mandates that Federal Civilian Executive Branch (FCEB) agencies remediate it by February 13, 2026. Broadcom has released patches, and organizations are advised to upgrade to the latest secure versions of vCenter Server. Additional mitigation measures include network segmentation to restrict vCenter access to trusted administrative networks, monitoring for anomalous DCERPC traffic, and auditing access logs for unauthorized attempts. With the remediation deadline approaching, enterprises must act swiftly to prevent exploitation by automated attack tools.