CVE-2024-37085

VMware ESXi Authentication Bypass Vulnerability

n/a

CVSS

26.0%

EPSS (exploit prob.)

97.8%

EPSS percentile

Yes

Actively exploited

Yes

Ransomware use

2024-07-30

Added

MITRE ATT&CK techniques

How this vulnerability maps to adversary behaviour, from the Center for Threat-Informed Defense's public CVE→ATT&CK mappings. Use it to check whether your detections already cover the technique.

Technique	Name	Relationship
T1078	Valid Accounts	exploitation technique
T1068	Exploitation for Privilege Escalation	primary impact
T1608.001	Upload Malware	secondary impact

Summary

VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD.

Affected software

Vendor: VMware · Product: ESXi

Weakness types (CWE):

What to do

This vulnerability appears in CISA's Known Exploited Vulnerabilities catalog, meaning it is being exploited in the wild. Prioritize patching affected systems and verify exposure across your estate.

Related vulnerabilities in VMware

CVE	Name	EPSS	Exploited
CVE-2021-22005	VMware vCenter Server File Upload Vulnerability	100.0%	Yes
CVE-2021-21985	VMware vCenter Server Improper Input Validation Vulnerability	100.0%	Yes
CVE-2022-22954	VMware Workspace ONE Access and Identity Manager Server-Side Template Injection	100.0%	Yes
CVE-2022-22965	Spring Framework JDK 9+ Remote Code Execution Vulnerability	99.7%	Yes
CVE-2021-21972	VMware vCenter Server Remote Code Execution Vulnerability	99.5%	Yes
CVE-2023-34048	VMware vCenter Server Out-of-Bounds Write Vulnerability	99.4%	Yes
CVE-2023-20887	Vmware Aria Operations for Networks Command Injection Vulnerability	98.3%	Yes
CVE-2022-22947	VMware Spring Cloud Gateway Code Injection Vulnerability	98.3%	Yes

Is your domain exposed?

Run a free, instant security report for any domain — exposure score, email auth, TLS and breach metadata.

Get your free report

All information is aggregated from public sources for awareness only and does not constitute an accusation or a security assessment. No personal data or credentials are published.