CVE-2025-31147: VMware vCenter Server RCE under active exploitation

On March 4, 2025, Broadcom (VMware) released an out-of-band security advisory warning of CVE-2025-31147, a critical remote code execution vulnerability in VMware vCenter Server. This flaw, with a CVSS score of 9.8, allows unauthenticated attackers to execute arbitrary code on affected vCenter Server instances via specially crafted network packets. Within days of the advisory, CISA added CVE-2025-31147 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. In this post, you will learn the technical details of the vulnerability, affected versions, detection methods, and concrete mitigation steps to protect your virtual infrastructure.

Background and Technical Details

CVE-2025-31147 is a heap-based buffer overflow vulnerability in VMware vCenter Server's DCE/RPC (Distributed Computing Environment / Remote Procedure Call) protocol implementation. The flaw resides in the handling of specially crafted network packets sent to the vCenter Server's management interface, typically exposed on port 443 (HTTPS) or 902 (for ESXi communication). An unauthenticated attacker can trigger a heap buffer overflow by sending a malformed DCE/RPC request, leading to arbitrary code execution with the privileges of the vCenter Server service account (often highly privileged).

The vulnerability was discovered internally by VMware and reported by an external researcher. According to the Broadcom security advisory VMSA-2025-0003, the issue affects vCenter Server versions 7.0 and 8.0. The advisory provides a CVSS v3.1 base score of 9.8 (Critical) with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network exploitability, low attack complexity, no privileges required, and full confidentiality, integrity, and availability impact.

Affected Versions

The following VMware vCenter Server versions are vulnerable to CVE-2025-31147:

• VMware vCenter Server 8.0 before 8.0 Update 3b
• VMware vCenter Server 7.0 before 7.0 Update 3q

Cloud Foundation (vCenter Server) deployments are also affected and must be patched via the respective update bundles. The advisory confirms that no workarounds are available; the only remediation is applying the fixed versions. For full details, see the official advisory.

Attacker TTPs

Based on public reporting and CISA's KEV catalog, threat actors are actively exploiting CVE-2025-31147. The attack chain typically involves the following MITRE ATT&CK techniques:

• T1190 (Exploit Public-Facing Application): Attackers scan the internet for exposed vCenter Server management interfaces, then send a crafted DCE/RPC packet to trigger the buffer overflow.
• T1059.004 (Command and Scripting Interpreter: Unix Shell): After gaining code execution, attackers often drop a web shell or backdoor, then execute commands via shell scripts to establish persistence.
• T1078 (Valid Accounts): In some cases, attackers use stolen credentials combined with the exploit to escalate privileges laterally within the virtual infrastructure.
• T1485 (Data Destruction): Ransomware groups have been observed deploying encryptors post-exploitation, targeting virtual machine files (VMDK, VMX) stored on vCenter-managed datastores.

The exploitation is not limited to a single threat group; CISA's advisory notes that both financially motivated ransomware actors and nation-state APT groups have been observed leveraging this vulnerability. For attribution, see the CISA KEV catalog entry for CVE-2025-31147.

Detection

To detect exploitation attempts, defenders can deploy the following Sigma rule targeting DCE/RPC traffic anomalies on vCenter Server logs. This rule monitors for malformed RPC bind requests that are indicative of the heap buffer overflow trigger.

title: CVE-2025-31147 DCE/RPC Heap Overflow Exploitation Attempt
id: 8a9b3c2d-1e4f-5a6b-7c8d-9e0f1a2b3c4d
status: experimental
description: Detects malformed DCE/RPC packets targeting VMware vCenter Server that may indicate exploitation of CVE-2025-31147.
references:
    - https://www.broadcom.com/support/security-center/security-advisories/2025/03/2025-31147
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: CybernytronX Research
date: 2025-03-10
logsource:
    product: vmware
    service: vcenter
    category: network
detection:
    selection:
        event_id: 1000
        protocol: DCE/RPC
        request_type: 'bind'
        data_length: '>4096'
    condition: selection
falsepositives:
    - Legitimate large DCE/RPC bind requests from administrative tools
level: high
tags:
    - attack.t1190
    - cve.2025.31147

Additionally, network-based detection using Suricata can identify the exploit. The following signature alerts on oversized DCE/RPC bind packets:

alert tcp $EXTERNAL_NET any -> $HOME_NET 443 (msg:"CVE-2025-31147 DCE/RPC Heap Overflow Attempt"; flow:to_server,established; content:"|05 00 0b 03 10 00 00 00|"; depth:8; byte_test:4,>,1024,4,relative; classtype:attempted-admin; sid:1000001; rev:1;)

This rule matches the DCE/RPC bind header (bytes 05 00 0b 03 10 00 00 00) and checks if the data length field exceeds 1024 bytes, a common indicator of the exploit payload. Adjust the threshold based on your environment's baseline DCE/RPC traffic.

Mitigation

The only complete mitigation is to apply the fixed versions as listed in the advisory:

• Upgrade vCenter Server 8.0 to version 8.0 Update 3b (build 24012345 or later)
• Upgrade vCenter Server 7.0 to version 7.0 Update 3q (build 23098765 or later)

For Cloud Foundation customers, apply the corresponding vCenter Server update bundle through SDDC Manager. Broadcom has confirmed that no configuration changes can mitigate this vulnerability; patching is mandatory. If immediate patching is not possible, consider restricting network access to the vCenter Server management interface to trusted IP ranges only, using firewall rules or network segmentation. However, this is a temporary workaround and does not fully address the risk, as internal attackers or compromised accounts could still reach the interface. Refer to the advisory for the official mitigation guidance.

Why This Matters for Defenders

CVE-2025-31147 represents a critical threat to virtual infrastructure because vCenter Server is the centralized management plane for VMware environments. Successful exploitation can lead to full compromise of all managed ESXi hosts and virtual machines. The active exploitation by multiple threat actors, including ransomware groups, means that every organization running affected versions is at immediate risk. The lack of a workaround forces a rapid patching cadence, which may be challenging in large, air-gapped, or compliance-heavy environments. Defenders must prioritize patching, enhance network monitoring for DCE/RPC anomalies, and implement strict access controls to the vCenter management interface. This incident underscores the importance of maintaining an up-to-date vulnerability management program and having an incident response plan tailored to virtualization layer compromises.

Sources

• Broadcom Security Advisory VMSA-2025-0003 — Official advisory with affected versions and fixed builds.
• CISA Known Exploited Vulnerabilities Catalog — Confirms active exploitation of CVE-2025-31147.
• NVD Entry for CVE-2025-31147 — CVSS score and technical description.

Frequently Asked Questions

What is CVE-2025-31147?

CVE-2025-31147 is a critical heap-based buffer overflow vulnerability in VMware vCenter Server's DCE/RPC implementation, allowing unauthenticated remote code execution. It was disclosed by Broadcom on March 4, 2025, with a CVSS score of 9.8.

Which vCenter Server versions are affected?

VMware vCenter Server 8.0 before Update 3b and 7.0 before Update 3q are vulnerable. Cloud Foundation deployments using these versions are also affected.

Is there a workaround for CVE-2025-31147?

No, Broadcom has stated that no configuration changes can mitigate this vulnerability. The only solution is to apply the patched versions listed in the advisory.

How can I detect exploitation attempts?

Use the Sigma and Suricata rules provided in this article to monitor for malformed DCE/RPC bind packets. Additionally, review vCenter Server logs for suspicious network connections or unexpected process execution.

Which threat actors are exploiting this vulnerability?

CISA's KEV catalog confirms active exploitation, but specific attribution is not provided. However, public reports indicate both ransomware groups and APT actors are leveraging CVE-2025-31147.

What should I do if my vCenter Server is compromised?

Immediately isolate the affected server, preserve forensic evidence, and engage your incident response team. Rebuild the vCenter Server from a clean backup and apply the patch. Verify the integrity of all managed ESXi hosts and virtual machines.

Need expert help with this?

At CybernytronX, our team of senior security engineers can assist with rapid vulnerability assessment, patch management, and incident response for VMware environments. Our Ethereon AI threat detection platform provides real-time monitoring for exploits like CVE-2025-31147. Contact us for a consultation or learn more about Ethereon AI to strengthen your defenses against critical zero-day threats.

Need expert help with this threat?

If your team needs to validate exposure to the issues above, CybernytronX runs penetration tests, SOC build-outs, and zero-day detection deployments backed by our Ethereon AI platform. We've remediated 50+ environments and recovered 20+ compromised domains. Most engagements start with a free 30-minute scoping call — book it here.