🔐 CVE Alert

CVE-2023-34048

CRITICAL 9.8 ⚠️ CISA KEV

VMware vCenter Server Out-of-Bounds Write Vulnerability

CVSS Score
9.8
EPSS Score
0.0%
EPSS Percentile
0th

vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds write potentially leading to remote code execution.

Vendor vmware
Product vmware vcenter server
Ecosystems
Industries
TechnologyEnterprise
Published Oct 25, 2023
Last Updated Oct 21, 2025
⚠️ Actively Exploited — Act Now

Get instant alerts for vmware vmware vcenter server

This vulnerability is actively exploited in the wild. Set up free real-time alerts so you're first to know about threats like CVE-2023-34048.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Affected Versions

VMware / VMware vCenter Server
8.0 < 8.0U2 7.0 < 7.0U3o
VMware / VMware Cloud Foundation (VMware vCenter Server)
5.x 4.x

References

NVD ↗ CVE.org ↗ EPSS Data ↗
vmware.com: https://www.vmware.com/security/advisories/VMSA-2023-0023.html cisa.gov: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-34048 vicarius.io: https://www.vicarius.io/vsociety/posts/understanding-cve-2023-34048-a-zero-day-out-of-bound-write-in-vcenter-server