CVE-2024-38813
Privilege escalation vulnerability
The vCenter Server contains a privilege escalation vulnerability. A malicious actor with network access to vCenter Server may trigger this vulnerability to escalate privileges to root by sending a specially crafted network packet.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Privilege escalation vulnerability
The vCenter Server contains a privilege escalation vulnerability. A malicious actor with network access to vCenter Server may trigger this vulnerability to escalate privileges to root by sending a specially crafted network packet.
- Record
CVE-2024-38813- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-273, CWE-250
- Updated
- 2026-11-02
EUVDEUVD-2024-37704
The vCenter Server contains a privilege escalation vulnerability. A malicious actor with network access to vCenter Server may trigger this vulnerability to escalate privileges to root by sending a specially crafted network packet.
- Record
EUVD-2024-37704- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-66vj-hxh5-x3jh
The vCenter Server contains a privilege escalation vulnerability. A malicious actor with network...
The vCenter Server contains a privilege escalation vulnerability. A malicious actor with network access to vCenter Server may trigger this vulnerability to escalate privileges to root by sending a specially crafted network packet.
- Record
GHSA-66vj-hxh5-x3jh- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-250, CWE-273
- Updated
- 2026-11-02
CISA KEV No score
VMware vCenter Server Privilege Escalation Vulnerability
VMware vCenter contains an improper check for dropped privileges vulnerability. This vulnerability could allow an attacker with network access to the vCenter Server to escalate privileges to root by sending a specially crafted packet.
- Record
CVE-2024-38813- Weakness
- CWE-250, CWE-273
- Updated
- 2026-11-02
NVD
The vCenter Server contains a privilege escalation vulnerability. A malicious actor with network access to vCenter Server may trigger this vulnerability to escalate privileges to root by sending a specially crafted network packet.
- Record
CVE-2024-38813- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-250, CWE-273
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation | ||
| first indexed | CVE List, EUVD, GitHub Advisories, CISA KEV, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-38813 is a high vulnerability (CVSS 7.5) in Vmware Vcenter Server, published September 17, 2024. CISA lists it as known to be exploited, since November 20, 2024. EUVD reports exploitation since November 20, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 17.4%, the 97th percentile. No source names a fixed version.