Critical VMware vCenter Server Patch

VMware released advisory VMSA-2024-0019 for two critical vCenter Server vulnerabilities: CVE-2024-38812 (heap overflow in DCERPC enabling remote code execution, CVSS 9.8) and CVE-2024-38813 (network-based privilege escalation to root, CVSS 7.5). Affected products include vCenter, VMware vSphere and VMware Cloud Foundation; administrators are advised to take a non-memory snapshot of the VCSA and apply the vendor updates promptly. The report also states that Kudelski Security/CFC has not observed active exploitation to date.