The Wolves Are Already Inside the vCenter Pen, and Your Shepherds Just Noticed
I want you to sit with that for a moment. The wolves did not knock. They did not announce themselves. They walked through a hole in the fence designated CVE-2024-37079 while your organization was presumably busy migrating something sacred to the Sky Pasture.
CISA has formally added this VMware vCenter vulnerability to its Known Exploited Vulnerabilities catalog. "Known Exploited." Those two words should keep you awake. This is not theoretical. This is not a fire drill. The flock is already bleeding.
For those unfamiliar with vCenter: it is the centralized management platform for VMware virtualized environments. Think of it as the master gate to every pen on the property. A heap-overflow flaw in the DCERPC protocol implementation means a sufficiently motivated wolf can send maliciously crafted packets and potentially achieve remote code execution. No credentials required. No invitation necessary.
In my day, we ran critical infrastructure on systems that were not reachable from every corner of the internet by default. You wanted access, you drove to the building. Physically. In weather. That was security.
Now we have vCenter instances apparently lounging in exposed network segments like lambs at a petting zoo. Remarkable. Truly remarkable.
CISA's directive gives federal agencies until a fixed remediation deadline to apply the ointment. Private organizations are, as usual, politely encouraged to follow along. "Politely encouraged." I have seen that phrase before. It means the shepherds will forward the email and return to their dashboards.
The confirmed in-the-wild exploitation is what elevates this from "concerning" to "professionally embarrassing." Someone found this hole in the fence, walked through it, and your detection tools apparently filed the incident under "maybe later."
Modern endpoint tools would have caught this immediately, I am told. By vendors. Who sell modern endpoint tools. I remain skeptical.
Remediation
Consult VMware's advisory and apply the designated shearing immediately. VMware released patches for this months ago. If you have not applied them, I do not know what to tell you, except that I am not surprised.
Audit your network segmentation. vCenter should not be reachable from the general population. Place it behind your electric fence, inside a dedicated management network, with access restricted to specific administrative hosts only.
If you are running affected versions and cannot patch immediately, restrict external access to vCenter services as a temporary measure. Not ideal. Better than nothing. Barely.
Enable logging. Review it. Actually review it, do not simply confirm that logs are being generated and walk away feeling accomplished.
The hole in the fence has been documented, catalogued, and exploited. The only remaining question is whether your flock is still intact.
Go check. I will wait here, next to my magnetic tape backups, which have never once been remotely exploited.
Original Report: https://thehackernews.com/2026/01/cisa-adds-actively-exploited-vmware.html