cbcvebase.
CVE-2024-37085
published 2024-06-25

CVE-2024-37085: VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an…

PriorityP187high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
KEVITWRansomware
CISA Known Exploited Vulnerabilitydue 2024-08-20
Exploited in the wild
EPSS
26.77%
97.8th percentile
VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management https://blogs.vmware.com/vsphere/2012/09/joining-vsphere-hosts-to-active-directory.html by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD.

Affected

3 ranges
VendorProductVersion rangeFixed in
vmwarecloud_foundation>= 4.0 < 5.25.2
vmwareesxi
vmwareesxi

Detection & IOCsextracted from sources · hover to see the quote

commandC:\Windows\host.exe -s [8-digit numeric string] svc
command/c ping 1.1.1[.]1 -n 10 > Nul & fsutil file setZeroData offset=0 length=503808 c:\windows\host.exe & Del c:\windows\host.exe /F /Q
versionESXi80U3-24022510
  • Monitor for creation of an Active Directory group named 'ESX Admins' (or 'ESXi Admins') on domain-joined ESXi hosts, especially if the group was recently re-created after deletion — this is the core exploitation mechanism for CVE-2024-37085.
  • Detect NTLM authentication anomalies on ESXi/Windows hosts: threat actor primarily used NTLM while legitimate users used Kerberos — a divergence in authentication protocol usage is a lateral movement indicator.
  • Detect the BlackByte ransomware self-deletion command pattern: use of 'fsutil file setZeroData' followed by 'Del /F /Q' on the ransomware binary, preceded by a ping delay loop.
  • Detect the BlackByte ransomware execution pattern: 'host.exe' launched from C:\Windows with '-s' parameter followed by an 8-digit numeric string and 'svc' argument, which installs ransomware as a service.
  • Use Qualys QID 216333 and QID 216331 to detect CVE-2024-37085 on VMware ESXi 8.0 and 7.0 assets respectively.
  • ·CVE-2024-37085 exploitation requires the attacker to first obtain high AD privileges (e.g., Domain Admin) before they can create or re-create the 'ESX Admins' group — the vulnerability is not remotely exploitable without prior privilege escalation.
  • ·ESXi 7.0 and VMware Cloud Foundation 4.x have no patch planned for CVE-2024-37085; administrators must rely on configuration workarounds for AD group privilege defaults.

CVSS provenance

nvdv3.17.2HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
vulncheck6.8MEDIUM
cisa7.2HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.