VMware Horizon Server Alert: Patch Now to Prevent Remote Code Execution Vulnerabilities

As cybersecurity threats continue to evolve, VMware has issued a critical alert to its customers regarding multiple remote code execution vulnerabilities affecting various products, including the VMware Horizon server. These vulnerabilities stem from Apache Log4j (CVE-2021-44228 and CVE-2021-45046) and have been actively exploited by threat actors.

The exploitation of these flaws allows attackers to deploy custom web shells into the VM Blast Secure Gateway service, granting them access to target networks. Once a web shell is installed, malicious activities such as data exfiltration or ransomware deployment can be carried out.

To illustrate the severity of this issue, NHS has reported an unknown threat group targeting VMware Horizon servers running affected versions to establish persistence within compromised networks. The UK National Health Service's security team also spotted threat actors exploiting the Log4Shell vulnerability to hack VMWare Horizon servers and install web shells.

One notable example is a China-based ransomware operator tracked as DEV-0401, which has been observed exploiting the CVE-2021-44228 vulnerability in Log4j 2 (aka #log4shell) targeting internet-facing systems running VMware Horizon.

Given the urgency of this situation, VMware strongly urges customers to patch their Horizon servers immediately to defend against these active attacks. It is crucial for organizations to prioritize security and take necessary measures to mitigate potential risks.

By staying informed about ongoing threats and taking proactive steps to secure your infrastructure, you can help safeguard your organization from potential cyber-attacks.

Vmware horizon server