{"id":"CVE-2024-38813","kind":"vulnerability","aliases":["CVE-2024-38813"],"related":[],"title":"The vCenter Server contains a privilege escalation vulnerability","description":"VMware vCenter contains an improper check for dropped privileges vulnerability. This vulnerability could allow an attacker with network access to the vCenter Server to escalate privileges to root by sending a specially crafted packet.\n\nCISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","summary":"VMware vCenter Server has an improper check for dropped privileges that lets a network attacker send a crafted packet and gain root on the vCenter Server. CISA lists it as actively exploited in the wild.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2024-11-20T00:00:00+00:00","products":[{"name":"VMware vCenter Server","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"vmware cloud foundation","fixed":["5.2"],"affected":">= 4.0, < 5.2","ecosystem":"vendor"},{"name":"vmware vcenter server","fixed":[],"affected":"= 7.0","ecosystem":"vendor"},{"name":"vmware vcenter server","fixed":[],"affected":"= 8.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","self-hosted","vcenter","vendor","vmware"],"not_affected_if":["managed-hosting"],"how_to_check":null,"fix":"Apply the vendor mitigation or patch per VMware's advisory for CVE-2024-38813; if no mitigation is available, discontinue use of the product per CISA's required action.","status":"open","published_at":"2024-09-17T18:15:04+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:56:09+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-10-23T20:56:09Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigation or patch per VMware's advisory for CVE-2024-38813; if no mitigation is available, discontinue use of the product per CISA's required action.","reach":"network","impact":"high","summary":"VMware vCenter Server has an improper check for dropped privileges that lets a network attacker send a crafted packet and gain root on the vCenter Server. CISA lists it as actively exploited in the wild.","category":"vendor","who_cares":["vmware","vcenter","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker gains root on the vCenter Server over the network","analyst_note":"Find the VMware advisory for CVE-2024-38813 to get affected and fixed versions and the exact mitigation steps; the sources give neither.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000459,"input_tokens":2833,"output_tokens":352,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2024':10A,13A '-38813':11A,14A 'access':87C 'action':105C 'activ':64B 'allow':82C 'appli':106C 'attack':48B,84C 'check':40B,74C 'cisa':60B,103C 'cloud':19A 'contain':4A,71C 'could':81C 'craft':51B,101C 'cve':9A,12A 'discontinu':112C 'drop':42B,76C 'escal':7A,93C 'exploit':27B,65B 'foundation':20A 'gain':54B 'host':30B 'improp':39B,73C 'instruct':110C 'let':45B 'list':61B 'mitig':107C,118C 'network':47B,86C 'packet':52B,102C 'per':108C 'privileg':6A,43B,77C,94C 'product':116C 'requir':104C 'root':55B,96C 'self':29B 'self-host':28B 'send':49B,98C 'server':3A,17A,23A,26A,36B,59B,91C 'special':100C 'unavail':120C 'use':113C 'vcenter':2A,16A,22A,25A,31B,35B,58B,70C,90C 'vendor':32B,109C 'vmware':15A,18A,21A,24A,33B,34B,69C 'vulner':8A,78C,80C 'wild':68B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2024-09-17T18:15:04+00:00","kev":{"dateAdded":"2024-11-20","dueDate":"2024-12-11","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@vmware.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2024-38813","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-38813","severity":null,"published_at":"2024-11-20T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T14:39:38+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-38813","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38813","severity":null,"published_at":"2024-09-17T18:15:04+00:00","modified_at":"2026-06-17T07:41:05+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}