EXPOSURES › CVE-2024-37085

CVE-2024-37085

CRITICAL ⌖ ON CISA KEV · EXPLOITED

DETAIL

SourceCISA-KEV · kev Published2024-07-30 Referencehttps://nvd.nist.gov/vuln/detail/CVE-2024-37085 ↗

⚡ RCE ⌖ EXPLOITED IN THE WILD SHAME 78/100 ransomwareexploited-in-wildunpatchedauth-bypass

VMware ESXi allows attackers with AD permissions to regain full host access by recreating a deleted admin group.

An authentication bypass in VMware ESXi lets attackers with Active Directory permissions restore a deleted admin group to reclaim full host control. DIBs must ensure ESXi hosts using AD for user management are patched and monitored for group recreation attempts. This failure risks unpatched exposure and potential ransomware entry.

Shame score — A critical, actively exploited vulnerability linked to ransomware that allows full host access via a simple group recreation, indicating severe negligence in patching and AD integration.

▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

PLAYERS IMPLICATED

VMware, Inc. · vendor ESXi · product

DESCRIPTION

VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD.

AFFECTED FEDRAMP PRODUCTS · 2

PRODUCT	PROVIDER	STATUS	MATCH
VMware Government Services (VGS) VMware, Inc.	VMware, Inc.	Authorized	vendor-exact · 0.90
Workspace ONE VMware, Inc.	VMware, Inc.	Authorized	vendor-exact · 0.90