CVE-2024-37085: VMware ESXi Authentication Bypass Vulnerability

CVE-2024-37085 is an authentication bypass vulnerability in VMware ESXi. When an ESXi host is configured to use Active Directory for user management, a malicious actor who already holds sufficient AD permissions can regain full administrative access to that host by re-creating a previously deleted AD group (the default name is “ESXi Admins”).

Because the flaw allows complete host takeover and is known to be used by ransomware operators, organizations running AD-integrated ESXi hosts should treat it as a high-priority risk and confirm their exposure and remediation status against the vendor advisory.

How it works

The vulnerability is classified as CWE-305 (authentication bypass). ESXi can be joined to Active Directory so that membership in a designated AD group grants administrative rights on the hypervisor. If that group is later deleted from AD, the host continues to trust the group name. An attacker who can create groups in the same AD domain simply re-creates a group with the exact configured name. Once the group exists again, any account the attacker places in it is treated by ESXi as a full administrator, bypassing the intended authentication and authorization controls.

No remote unauthenticated exploit is required; the attacker must already possess enough AD privileges to create or restore the group. The result, however, is unrestricted access to the ESXi host and therefore to every virtual machine it runs.

Am I affected? How to find it in your systems

VMware ESXi is commonly deployed as the bare-metal hypervisor in private clouds, virtual desktop infrastructure, and enterprise server farms. Any host that has been configured for Active Directory authentication is potentially in scope.

• Inventory all ESXi hosts (vCenter inventory, configuration-management databases, or network discovery scripts that identify VMware management interfaces).
• On each host, check whether Active Directory authentication is enabled and note the exact name of the administrative group that was configured (default is “ESXi Admins”).
• In Active Directory, verify whether that group currently exists and whether its membership is tightly controlled.
• Review ESXi and vCenter authentication logs for unexpected successful logins by accounts that should not have administrative rights, especially shortly after group-creation events in AD.

Exact affected versions and configuration details must be confirmed against the vendor advisory; do not rely solely on the presence or absence of a particular build number.

How to remediate

Apply the vendor-supplied update or mitigation for CVE-2024-37085 as soon as it can be tested and staged. Follow the CISA-required action: implement the mitigations described in the vendor instructions, or discontinue use of the product if no mitigations are available.

• After patching, re-validate that AD group membership still maps correctly to ESXi privileges and that no unauthorized groups with the configured name exist.
• Rotate any credentials that may have been used while the host was vulnerable.
• Harden the AD integration by restricting who can create or restore groups, enabling AD auditing of group-creation events, and limiting the ESXi administrative group to the smallest necessary set of accounts.

If you can't patch immediately

Until the vendor update can be applied, reduce risk with compensating controls:

• Network-segment ESXi management interfaces so they are reachable only from trusted jump hosts or management networks.
• Disable Active Directory authentication on ESXi hosts that do not strictly require it; fall back to local accounts with strong, unique passwords and multi-factor authentication where supported.
• Monitor AD for the creation of any group matching the ESXi administrative group name and alert on membership changes.
• Increase logging and alerting on ESXi authentication events; forward logs to a SIEM for correlation with AD group-creation activity.
• If a web application firewall or virtual-patching capability sits in front of management interfaces, apply rules that restrict access to known-good source addresses (confirm rule efficacy against the vendor advisory).

If your data may have been exposed

Actively exploited authentication-bypass vulnerabilities on hypervisors frequently lead to ransomware deployment and data theft. If you discover evidence of unauthorized ESXi access, treat the incident as a potential breach: isolate affected hosts, preserve forensic images, and begin containment and recovery according to your incident-response plan. You can also run a free exposure scan of your email address to check whether associated credentials or personal data already appear in known breach data sets.