CVE-2023-20864 is a critical deserialization vulnerability in VMware Aria Operations for Logs and Cloud Foundation, allowing unauthenticated attackers with network access to execute arbitrary code as root. With a CVSS score of 9.8, it presents a low-complexity attack vector leading to complete compromise of confidentiality, integrity, and availability. While not yet in CISA's KEV catalog, exploit code and Nuclei templates are publicly available, and it has garnered significant community discussion and media coverage, indicating a high likelihood of active exploitation. Organizations should prioritize patching immediately.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 8.10.2, < 8.12.0CPE matchmatch criteria | cpe:2.3:a:vmware:aria_operations_for_logs:*:*:*:*:*:*:*:* | ||
>= 4.0, <= 4.5CPE matchmatch criteria | cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.