CVE-2023-34048
CRITICALVulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V14 - Configuration Dependency management, component inventory
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | Critical risk (CVSS 9.8, EPSS 93.2%). vCenter Server controls entire VMware virtual infrastructure. Compromising vCenter gives attackers control over all managed ESXi hosts and virtual machines, including the ability to access VM disk files containing sensitive data. |
| Exploit ScenarioDerived | UNC3886 exploited the vCenter vulnerability to gain code execution, then deployed VirtualPita/VirtualPie backdoors on ESXi hosts. These kernel-level backdoors persisted across reboots and provided undetectable access to all VMs running on compromised hosts. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 26, 2026
VMware vCenter Server contains an out-of-bounds write in the DCERPC protocol implementation allowing unauthenticated remote code execution, exploited by Chinese APT groups for ESXi infrastructure compromise.
Earlier versions of this analysis (1)
A critical out-of-bounds write vulnerability in vCenter Server's DCERPC protocol handling enables unauthenticated remote code execution. Exploited by Chinese state-sponsored actors (UNC3886) for virtual infrastructure compromise.
RemediationAI
Apply VMware security patches immediately. Check ESXi hosts for indicators of VirtualPita/VirtualPie. Restrict network access to vCenter management interfaces. Implement vCenter Server High Availability (VCHA) for detection.
Affected ProductsAI
VMware vCenter Server (affected versions before patches)
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The CWE-787 out-of-bounds write in the DCERPC protocol implementation allows a network-adjacent attacker to corrupt memory through crafted protocol messages. The exploitation requires only network access to the vCenter Server's DCERPC port (port 443 for vSphere Client embeds DCERPC handling).
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds write potentially leading to remote code execution.
Executive ViewAI
Organizations using vCenter Server face critical risk from CVE-2023-34048, a out-of-bounds write vulnerability rated CVSS 9.8. Exploitation could allow attackers to corrupt memory, crash the application, or potentially execute arbitrary code. This vulnerability is actively exploited in the wild (KEV-listed) and requires immediate remediation. Immediate patching is required per CISA KEV mandate.
Apply vendor patch. If immediate patching is not feasible: (1) Enable ASLR and DEP where available; (2) Implement network segmentation; (3) Monitor for exploitation indicators.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
GitHub PoC
Exploit-DB