Alerts

CISA Adds Critical VMware vCenter RCE Flaw to Exploited Vulnerabilities List

Zero Day Wire

— 1 min read
CISA Adds Critical VMware vCenter RCE Flaw to Exploited Vulnerabilities List

CISA has added CVE-2024-37079, a critical remote code execution vulnerability in VMware vCenter Server, to its Known Exploited Vulnerabilities catalog following confirmed active exploitation in the wild.

The flaw affects Broadcom's VMware vCenter Server, the centralized management platform for VMware vSphere environments. Organizations relying on vCenter for virtualization management face significant risk, as compromise of this system can provide attackers with lateral movement capabilities across entire virtualized infrastructures.

Vulnerability Details

CVE-2024-37079 is an out-of-bounds write vulnerability in vCenter Server's DCERPC (Distributed Computing Environment / Remote Procedure Calls) protocol implementation. The flaw stems from improper memory handling that allows unauthenticated attackers to trigger remote code execution by sending specially crafted network packets.

The attack vector is strictly network-based and requires no user interaction, making it particularly dangerous for internet-exposed management interfaces. While CISA has not confirmed use in ransomware campaigns, the vulnerability's characteristics make it highly attractive to initial access brokers and ransomware operators.

CISA Mandate

Federal Civilian Executive Branch agencies must remediate the vulnerability by February 13, 2026. CISA urges all organizations to prioritize patching immediately or discontinue use if mitigations are unavailable.

Recommendations

Organizations should apply patches from Broadcom's security advisory immediately. Security teams should ensure vCenter management interfaces are not exposed to the public internet, restrict access to trusted administrative networks, implement monitoring for anomalous DCERPC traffic, and audit access logs for unauthorized connection attempts.

Broadcom has released updates addressing this vulnerability.

Read more

ClickFix Campaign Compromises Legitimate Sites to Deploy MIMICRAT — A Custom C++ RAT With 22 Post-Exploitation Commands

ClickFix Campaign Compromises Legitimate Sites to Deploy MIMICRAT — A Custom C++ RAT With 22 Post-Exploitation Commands

Elastic Security Labs has disclosed a new ClickFix campaign that leverages compromised legitimate websites as delivery infrastructure to deploy a previously undocumented remote access trojan dubbed MIMICRAT (also tracked as AstarionRAT). The campaign, discovered earlier this month, demonstrates significant operational sophistication — from multi-stage PowerShell chains that bypass Windows security controls

By Zero Day Wire
ShinyHunters Linked to Device Code Vishing Attacks Targeting Microsoft Entra Accounts via OAuth 2.0 Abuse

ShinyHunters Linked to Device Code Vishing Attacks Targeting Microsoft Entra Accounts via OAuth 2.0 Abuse

A new wave of attacks is combining voice phishing (vishing) with OAuth 2.0 device authorization abuse to compromise Microsoft Entra accounts at technology, manufacturing, and financial organizations — bypassing traditional phishing infrastructure entirely. Sources told BleepingComputer they believe the ShinyHunters extortion gang is behind the campaigns, which the threat actors

By Zero Day Wire