Critical RCE flaw CVE-2023-20887 in VMware vRealize exploited in the wild

VMware is warning customers that critical remote code execution vulnerability CVE-2023-20887 is being actively exploited in attacks.

VMware is warning customers that a critical remote code execution vulnerability in Aria Operations for Networks (Formerly vRealize Network Insight), tracked as CVE-2023-20887, is being actively exploited in the wild.

“VMware has confirmed that exploitation of CVE-2023-20887 has occurred in the wild,” reads the advisory.

In early June, Virtualization technology giant VMware released security patches to address three critical and high-severity vulnerabilities, including the flaw CVE-2023-20887.

VMware Aria Operations for Networks (formerly vRealize Network Insight) is a network monitoring tool that helps organizations build an optimized, highly available, and secure network infrastructure.

The vulnerability CVE-2023-20887 (CVSSv3 score of 9.8) is the most severe issue addressed by the company, it is a Command Injection flaw.

“A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in remote code execution.” reads the advisory published by VMware.

GreyNoise CEO Andrew Morris confirmed that the flaw is actively exploited in the wild.

The attacks observed by GreyNoise started on June 13 and originated from 2 IP addresses.

VMware Aria Operations for Networks

Researchers pointed out that POC exploit code for the CVE-2023-20887 flaw is available online.

?

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, VMware)

The post Critical RCE flaw CVE-2023-20887 in VMware vRealize exploited in the wild appeared first on Security Affairs.

Leave a Reply

Your email address will not be published. Required fields are marked *

Subscribe to our Newsletter