Broadcom released security advisories resolving a critical vulnerability in VMware vCenter Server and Cloud Foundation, tracked as CVE-2026-38812 (CVSS 9.8). The flaw is a heap-based buffer overflow within vCenter’s DCE/RPC protocol implementation. An unauthenticated remote attacker with network access to the management daemon can send crafted network packets to trigger memory corruption, achieving arbitrary remote code execution without user interaction. Broadcom patched the flaw alongside CVE-2026-38813 (CVSS 7.5), a local privilege escalation issue enabling attackers to obtain root privileges.

The vulnerability affects VMware vCenter Server 7.0 and 8.0 and VMware Cloud Foundation 4.x and 5.x. Discovered by researchers during China’s Matrix Cup competition, the flaw has seen active in-the-wild exploitation against enterprise virtual infrastructure, prompting CISA to mandate emergency remediation. Broadcom confirmed no workarounds exist, requiring administrators to apply cumulative updates to prevent infrastructure takeover.

Why it matters:

• Technical & Architecture Risk: Unauthenticated DCE/RPC heap corruption compromises the centralized hypervisor control plane, granting adversaries systemic control over all managed ESXi hosts, datastores, and guest virtual machines while completely bypassing guest-level endpoint detection.
• Strategic & Defender Imperative: Because no configuration workarounds exist, defenders must immediately deploy Broadcom’s updated security releases and isolate all vCenter management interfaces, restricting DCE/RPC network traffic to dedicated, out-of-band administrative VLANs.