VULNERABILITY INTELLIGENCE

CVE-2024-37085

CVSS score6.8 MEDIUM

EPSS probability26.77%

CISA KEVKnown exploited vulnerability

Published2024-06-25

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Known Exploited Vulnerability

VMware ESXi Authentication Bypass Vulnerability

Vendor / product: VMware / ESXi

Description

VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management https://blogs.vmware.com/vsphere/2012/09/joining-vsphere-hosts-to-active-directory.html by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD.

Weakness classification

nvd@nist.gov: CWE-287
134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-305

Primary references

security@vmware.com — Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch, Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0 — US Government Resource