CVE-2023-34048: listed in the CISA KEV catalog

CVE-2023-34048 · CVSS 9.8 CRITICAL · EPSS 99% · KEV 2024-01-22 · patch available

vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds write potentially leading to remote code execution.

Is CVE-2023-34048 exploited?

Listed in the CISA KEV catalog on 2024-01-22.
Federal remediation due 2024-02-12.
Past that date by 991 days.
EPSS puts exploitation in the next 30 days at 99%.
Public exploit code: none found in monitored sources.
Public detection rules exist.

Which products and versions are affected?

VMware · VMware vCenter Server · >= 8.0, < 8.0U2, >= 7.0, < 7.0U3o
VMware · VMware Cloud Foundation (VMware vCenter Server) · 5.x, 4.x

Is there a patch?

Yes. Update to one of these or later:

VMware vCenter Server 8.0	8.0U2
VMware vCenter Server 7.0	7.0U3o

From VMware's CVE record · VMware advisory

What PlainSec published about CVE-2023-34048

Google Cloud split its patch duty in two (2026-08-26)
Node kernel bugs on GKE COS nodes enable host escalation (2026-04-15)
Google Cloud issues multiple Linux kernel privilege escalation fixes for GKE nodes (2026-04-07)
Multiple Linux Kernel Flaws Elevate Privileges on GCP Container Nodes (2026-04-03)
Multiple High-Severity Cloud Vulnerabilities Impact Container Nodes (2026-04-01)

Primary sources

KEV and EPSS are re-checked daily. Record last updated 2026-10-28.