CVE-2024-37085

VMware ESXi is vulnerable to an authentication bypass (CWE-305) when the host is configured to use Active Directory for user management. An attacker who has sufficient Active Directory permissions can delete the AD group tied to ESXi administration (typically the default 'ESXi Admins' group) and then re-create it, causing ESXi to treat the re-created group as the original administrator group. This grants the actor full access to the ESXi host without needing ESXi credentials themselves. Only ESXi hosts that were joined to and configured with Active Directory for user management are affected; hosts using local authentication are not. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2024-07-30 with known ransomware use, and EPSS assigns a high 26.8% probability of exploitation in the next 30 days (98th percentile).

What to do: Apply the security updates or mitigations published in the vendor's (VMware/Broadcom) advisory for your ESXi release, per the CISA KEV required action. As interim mitigation, protect the configured AD admin group (default 'ESXi Admins') from deletion or re-create it with the original identity, and restrict AD permissions that allow arbitrary group deletion. Since ransomware use is known, audit AD logs for deletion/re-creation of the 'ESXi Admins' group and verify integrity of any AD-joined ESXi hosts.