⚠ Actively exploited in ransomware campaigns
This vulnerability is on the CISA Known Exploited Vulnerabilities list and has been used in known ransomware attacks. CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.. Due date: 2024-08-20.

CVE-2024-37085

Severity
7.2HIGH
EPSS
71.9%
top 1.26%
CISA KEV
KEVRansomware
Added 2024-07-30
Due 2024-08-20
Exploit
Exploited in wild
Active exploitation observed
Timeline
PublishedJun 25
KEV addedJul 30
KEV dueAug 20
Latest updateAug 28
CISA Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Description

VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management https://blogs.vmware.com/vsphere/2012/09/joining-vsphere-hosts-to-active-directory.html by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:HExploitability: 0.9 | Impact: 5.9

Affected Packages4 packages

CVEListV5vmware_esxi8.0ESXi80U3-24022510+1
NVDvmware/esxi7.0, 8.0+1
NVDvmware/cloud_foundation4.05.2
CVEListV5vmware_cloud_foundation4.x, 5.x+1

Patches

🔴Vulnerability Details

3
CVEList
CVE-2024-37085: VMware ESXi contains an authentication bypass vulnerability2024-06-25
GHSA
GHSA-485m-923f-95wx: VMware ESXi contains an authentication bypass vulnerability2024-06-25
VulnCheck
VMware ESXi Authentication Bypass Vulnerability2024

📋Vendor Advisories

1
CISA
VMware ESXi Authentication Bypass Vulnerability2024-07-30

🕵️Threat Intelligence

3
Talos
BlackByte blends tried-and-true tradecraft with newly disclosed vulnerabilities to support ongoing attacks2024-08-28
Bleepingcomputer
CISA warns of VMware ESXi bug exploited in ransomware attacks2024-07-30
Bleepingcomputer
Microsoft: Ransomware gangs exploit VMware ESXi auth bypass in attacks2024-07-29
CVE-2024-37085 (HIGH CVSS 7.2) | VMware ESXi contains an authenticat | cvebase.io