CVE-2024-22274: VMware vCenter Server: The vCenter Server contains an authenticated remote code execution vulnerability
This VMware advisory covers CVE-2024-22274 in VMware vCenter Server and VMware Cloud Foundation (vCenter Server).
- CVE-2024-22274
Key facts
- Vendor rating
- High, CVSS 7.2
- CISA KEV
- Not listed (catalogue checked )
- Affected
- VMware vCenter Server 8.0 before 8.0 U2b; VMware vCenter Server 7.0 before 7.0 U3q; VMware Cloud Foundation (vCenter Server) 5.x before 5.1.1 and 1 more below
- Fixed in
- 8.0 U2b, 7.0 U3q, 5.1.1
- Source published
- Source revised
- Listed by VulniPulse
Compiled by VulniPulse from the linked sources. How records are collected and checked.
Affected products & platforms
Description
The vCenter Server contains an authenticated remote code execution vulnerability. A malicious actor with administrative privileges on the vCenter appliance shell may exploit this issue to run arbitrary commands on the underlying operating system.
Affected products named by the advisory: VMware vCenter Server; VMware Cloud Foundation (vCenter Server).
Text from the source record.
- VMware vCenter Server 8.0 before 8.0 U2b
- VMware vCenter Server 7.0 before 7.0 U3q
- VMware Cloud Foundation (vCenter Server) 5.x before 5.1.1
- VMware Cloud Foundation (vCenter Server) 4.x
Official advisory · high-confidence parse· fetched ·verify at source
How to fix CVE-2024-22274
Upgrade to a fixed release named by VMware:
- 8.0 U2b
- 7.0 U3q
- 5.1.1
Support dates for the fixed release lines
- VMware vCenter 8.0: support ends
- VMware vCenter 7.0: support ended
- VMware vCenter 5.1: support ended
More VMware (Broadcom) advisories
CVE-2024-37081Jun 18, 2024VMware vCenter Server: The vCenter Server contains multiple local privilege escalationCVE-2021-21972Feb 24, 2021VMware vCenter Server: The vSphere Client (HTML5) contains a remote code executionCVE-2026-41012Aug 29, 2026BOSH: Traffic interception vulnerability in BOSH Director vCenter CPICVE-2026-41709Jul 30, 2026ESX insufficient logging vulnerabilityCVE-2026-41703Jul 30, 2026Out-of-bounds read vulnerabilityCVE-2026-47876Jul 30, 2026VMXNET3 out-of-bounds write vulnerability
VMware (Broadcom) advisories, May 2024All VMware (Broadcom) advisories
Get an email when VMware vCenter Server publishes the next one.
See VMware vCenter Server's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor future VMware (Broadcom) CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
