VMware is urging customers to patch a critical vulnerability discovered by external researchers in its Aria Automation multi-cloud infrastructure automation platform.
The vulnerability, tracked as CVE-2023-34063 and assigned a CVSS score of 9.9, affects Aria Automation prior to version 8.16, as well as Cloud Foundation.
The flaw has been described as a missing access control issue that could allow an authenticated attacker to gain unauthorized access to remote organizations and workflows.
VMware has released patches for each of the impacted versions and urged customers to install them as soon as possible.
The company noted that it's currently not aware of in-the-wild exploitation.
The Broadcom-owned virtualization giant has credited the Scientific Computing Platforms team at the Commonwealth Scientific and Industrial Research Organisation for reporting the vulnerability.
It's not uncommon for threat actors to exploit VMware product vulnerabilities in their attacks.
The known exploited vulnerabilities catalog maintained by the US security agency CISA currently includes 21 VMware bugs, including ones affecting Aria products.
This Cyber News was published on www.securityweek.com. Publication date: Tue, 16 Jan 2024 14:43:11 +0000