🔴 Critical: CISA: Critical VMware RCE flaw now exploited by ransomware gangs
-
CISA is warning that ransomware operators have joined the active exploitation of a critical VMware vCenter remote code execution vulnerability that was patched back in July. The flaw allows an unauthenticated attacker to execute code on exposed vCenter servers, and it has already been targeted in ongoing attacks prior to the ransomware groups picking it up.
Key points for defenders:
- The vulnerability affects VMware vCenter Server and carries a critical severity rating.
- A patch was released in July — organizations that have not yet applied it remain at risk.
- CISA confirms ransomware gangs are now among the threat actors exploiting the flaw.
- Internet-exposed vCenter instances are the primary target, so restricting access is essential.
If you manage vCenter in your environment, prioritize patching immediately and audit for signs of compromise. Isolate management interfaces from the public internet wherever possible, and review logs for unusual activity on any system that was exposed while unpatched.
Source: BleepingComputer
Has your organization already patched vCenter, or are you still working through the backlog?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login