VMware, Microsoft and Apple Patch Flaws Already Used in Attacks

Key Takeaways

• Attackers are exploiting enterprise vulnerabilities within hours or days of disclosure, reducing the value of patch schedules based only on CVSS scores.
• VMware vCenter, Microsoft Windows and Apple macOS incidents show how exposed infrastructure and privileged endpoints can turn one flaw into a larger intrusion.
• Browser sessions, AI coding assistants and software dependencies are expanding the attack surface beyond conventional credential and malware defenses.

The week's security activity carried a familiar warning: expensive incidents do not always begin with sophisticated access. Sometimes an exposed service, a compromised credential or a missed update is enough. Attackers then add persistence, steal authenticated sessions or use ransomware to complicate the investigation.

VMware vCenter provided the clearest example. A suspected China-nexus APT has been linked to exploitation of CVE-2024-59310, a directory-traversal vulnerability with a CVSS score of 9.8. The flaw can enable arbitrary code execution, an especially serious outcome for software that manages virtualized infrastructure.

In at least one investigated compromise, attackers installed a backdoor and reverse SSH binary before deploying Babuk-derived ransomware. QUIRSO assessed that encryption may have been a smoke screen rather than the operation's central objective. If so, the ransomware served two purposes: distracting defenders and destroying evidence associated with a broader intrusion.

That distinction matters. An incident initially classified as financially motivated ransomware could actually involve long-term espionage, infrastructure mapping or credential collection. Recovery teams focused only on restoring encrypted systems might overlook persistence elsewhere in the virtual environment.

The volume behind this problem is substantial. ENISA reported that 33,524 vulnerabilities were recorded in NIST's NVD between July 2023 and July 2024, with 9.3% rated critical and 21.8% rated high. ENISA's subsequent reporting counted 42,595 newly disclosed vulnerabilities globally, a 27% year-over-year increase, while 64% had a network attack vector.

Vulnerability disclosure is quickly followed by scanning. GeoServer patched a critical SQL injection vulnerability in versions 3.0.1, 2.28.5 and 2.27.6 after technical details became public. watchTowr observed exploitation within hours, including hundreds of attempts from a relatively small collection of IP addresses. Citrix NetScaler showed a similar pattern: Defused Cyber reported exploitation activity two calendar days after details of a heap overflow, likely CVE-2024-8452, became public.

Defenders now have less time for traditional monthly prioritization meetings. The CISA Known Exploited Vulnerabilities catalog added 245 actively exploited CVEs during the latest reporting window. For enterprise teams, confirmed exploitation, internet exposure and asset importance often provide more useful urgency signals than severity scores alone.

Endpoint flaws remain part of the picture. Lazarus Group exploited CVE-2024-68820, a Windows Ancillary Function Driver for WinSock privilege-escalation flaw, before Microsoft patched it in the August 2024 Patch Tuesday release. The Operation Dream Job campaign targeted defense and aerospace professionals in France, Germany, Brazil and India, delivering ForestTiger and a new backdoor called Troy through convincing employment approaches.

Apple also issued emergency fixes for CVE-2024-65400 in recent macOS versions, including macOS Sequoia 15.7.9 and macOS Sonoma 14.8.9. NCSC-NL received reports of exploitation against systems exposing Screen Sharing on port 5900. Root access and Monero miners were found on affected machines. A remote administration feature can quickly become a direct entry point when internet exposure goes unnoticed.

Browser security is shifting to reflect a rapidly growing threat vector; Zscaler research recently indicated browser exploits grew 297% year over year to 15.8 million attacks. Malware like Amnesia Stealer can clone authenticated Chromium profiles and remotely control them through the Chrome DevTools Protocol (CDP). SpecterOps separately showed how CDP could be activated inside live Google Chrome or Microsoft Edge processes after code execution. Instead of extracting cookies and replaying them elsewhere, an attacker can operate through the trusted browser already holding the session.

GhostSplice adds another layer by splitting malicious instructions across MCP tool descriptions, results and sampling messages. ASSET Group calls this cross-channel trust fragmentation. The technique maps broadly to the concerns captured by MITRE ATT&CK around exploiting exposed applications, but it also challenges how enterprises assess trust inside AI-assisted development workflows.

The practical response starts with exposure discovery, followed by patching based on active exploitation and business impact. Systems such as VMware vCenter, Citrix NetScaler, remote desktop services, browsers and AI tool connections require particular scrutiny. Continuous inventory, access reviews and session monitoring remain fundamental controls for identifying these exposed pathways before attackers do.