CVE-2024-37081: VMware vCenter Server: The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo
This VMware advisory covers CVE-2024-37081 in VMware vCenter Server and VMware Cloud Foundation.
- CVE-2024-37081
Key facts
- Vendor rating
- High, CVSS 7.8
- CISA KEV
- Not listed (catalogue checked )
- Affected
- VMware vCenter Server 8.0 before 8.0 U2d; VMware vCenter Server 7.0 before 7.0 U3r; VMware Cloud Foundation 5.x and 1 more below
- Fixed in
- 8.0 U2d, 7.0 U3r
- Source published
- Source revised
- Listed by VulniPulse
- Record changed
Compiled by VulniPulse from the linked sources. How records are collected and checked.
Affected products & platforms
Description
The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo. An authenticated local user with non-administrative privileges may exploit these issues to elevate privileges to root on vCenter Server Appliance.
Affected products named by the advisory: VMware vCenter Server; VMware Cloud Foundation.
Text from the source record.
- VMware vCenter Server 8.0 before 8.0 U2d
- VMware vCenter Server 7.0 before 7.0 U3r
- VMware Cloud Foundation 5.x
- VMware Cloud Foundation 4.x
Official advisory · high-confidence parse· fetched ·verify at source
How to fix CVE-2024-37081
Upgrade to a fixed release named by VMware:
- 8.0 U2d
- 7.0 U3r
Support dates for the fixed release lines
- VMware vCenter 8.0: support ends
- VMware vCenter 7.0: support ended
More VMware (Broadcom) advisories
CVE-2021-21972Feb 24, 2021VMware vCenter Server: The vSphere Client (HTML5) contains a remote code executionCVE-2025-22225Mar 4, 2025VMware ESXi vulnerabilityCVE-2024-22274May 21, 2024VMware vCenter Server: The vCenter Server contains an authenticated remote code executionCVE-2026-41012Aug 29, 2026BOSH: Traffic interception vulnerability in BOSH Director vCenter CPICVE-2026-41709Jul 30, 2026ESX insufficient logging vulnerabilityCVE-2026-41703Jul 30, 2026Out-of-bounds read vulnerability
VMware (Broadcom) advisories, June 2024All VMware (Broadcom) advisories
Get an email when VMware vCenter Server publishes the next one.
See VMware vCenter Server's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor future VMware (Broadcom) CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
