CVE-2024-37085
VMware ESXi Authentication Bypass Vulnerability
Description
CVE-2024-37085 is a medium-severity authentication bypass vulnerability in VMware ESXi with a CVSS v3.1 base score of 6.8. The flaw allows a malicious actor with sufficient Active Directory (AD) permissions to gain full administrative access to an ESXi host by re-creating the configured AD group ("ESXi Admins" by default) after it has been deleted. CISA has added CVE-2024-37085 to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of August 20, 2024, and critically, its ransomware association is classified as Known -- making it one of the confirmed ransomware attack vectors. With an EPSS score of 72.47% at the 98.7th percentile, this vulnerability is among the most actively exploited in the current threat landscape. It affects VMware ESXi 7.0, ESXi 8.0, and VMware Cloud Foundation 4.x through 5.1.x.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| vmware | cloud foundation | >= 4.0, < 5.2 |
| vmware | esxi | 7.0; 8.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
Weakness Type
Authentication Bypass via AD Group Re-Creation in VMware ESXi
CVE-2024-37085 is an authentication bypass vulnerability in VMware ESXi's Active Directory integration mechanism. When an ESXi host is configured to use Active Directory for user management, it relies on a specific AD group (by default named "ESXi Admins") to grant full administrative access to the hypervisor. The vulnerability allows an attacker who has sufficient AD privileges to create groups to re-create this AD group after it has been deleted, immediately gaining full ESXi administrator access. This represents a fundamental design flaw in how ESXi validates the identity and authorization of AD groups. Instead of binding to a specific group security identifier (SID), ESXi relies on the group name, meaning any newly created group with the same name is automatically trusted with administrative privileges.
Impact Analysis
The business impact of CVE-2024-37085 is critical despite its medium CVSS base score of 6.8, primarily because of its confirmed ransomware association and the strategic value of ESXi hosts in enterprise environments. Confidentiality is fully compromised (C:H) because ESXi administrator access provides direct access to all virtual machines running on the host, including their virtual disks, memory snapshots, and configuration files. An attacker can read the contents of any VM, extract credentials, exfiltrate databases, and access any data processed by the virtualized infrastructure.
Integrity faces maximum impact (I:H) as ESXi administrator access enables the attacker to modify VM configurations, inject malicious code into virtual disk images, tamper with VM snapshots, and create new VMs for lateral movement. The attacker can also modify ESXi host settings, disable security logging, and install malicious VIBs (vSphere Installation Bundles) for persistent backdoor access.
Availability is fully at risk (A:H), and this is where the ransomware connection is most devastating. Ransomware operators have used CVE-2024-37085 to gain ESXi access and then encrypt VM disk files (VMDK), rendering entire virtualized environments inoperable. A single compromised ESXi host can host dozens of production VMs, so encrypting one host can simultaneously take down an organization's entire server infrastructure. The EPSS score of 72.47% at the 98.7th percentile, combined with the confirmed ransomware classification, makes this one of the most operationally dangerous vulnerabilities for organizations running VMware infrastructure.
Exploit Maturity
CVE-2024-37085 has reached maximum operational exploit maturity with confirmed active exploitation and a direct confirmed ransomware association -- one of the few vulnerabilities explicitly classified as "Known" for ransomware use by CISA. The KEV catalog lists a remediation deadline of August 20, 2024, reflecting the urgency of the threat. The EPSS score of 72.47% at the 98.7th percentile places it among the most heavily exploited vulnerabilities globally.
Broadcom has published the security advisory (VMSA-2024-0013) detailing the vulnerability and available patches. Multiple ransomware groups have been observed exploiting this vulnerability to compromise VMware ESXi hosts and deploy ESXi-specific ransomware that encrypts VMDK files. The attack is particularly effective because it leverages existing Active Directory compromise (which many ransomware operators achieve early in their attack chain) to pivot into the virtualization layer, which often lacks the same level of security monitoring as the Windows domain. The high privileges required (PR:H) reflect the need for AD group creation rights, but ransomware operators who have already compromised a domain controller have these privileges by default.
Remediation
-
Apply VMware ESXi patches immediately. Install the security updates from Broadcom's security advisory (VMSA-2024-0013). For ESXi 8.0, apply the latest update that addresses this vulnerability. For ESXi 7.0, apply the corresponding patch. For VMware Cloud Foundation, update to version 5.2 or later.
-
Verify and harden ESXi AD integration configuration. Review the AD group used for ESXi administration. If using the default "ESXi Admins" group name, change it to a non-default, unpredictable name and restrict who can create or modify this group in Active Directory. Implement AD group monitoring to detect unauthorized group creation or modification events.
-
Protect Active Directory from compromise. Since CVE-2024-37085 requires AD privileges to exploit, securing AD is a critical dependency. Implement tiered administration, protect domain controllers with enhanced security, enable privileged access workstations (PAWs), and monitor for indicators of AD compromise such as DCSync attacks, golden ticket creation, and unauthorized group modifications.
-
Implement ESXi host monitoring and lockdown mode. Enable ESXi lockdown mode to restrict direct access to ESXi hosts and force management through vCenter. Deploy syslog forwarding from ESXi hosts to a SIEM to detect unauthorized login attempts, configuration changes, and VM manipulation activities.
-
Develop ESXi-specific backup and recovery procedures. Given the confirmed ransomware association, ensure that VM backups are stored on infrastructure that is isolated from the VMware environment and Active Directory domain. Implement immutable backup solutions that cannot be encrypted or deleted even if the ESXi host and AD domain are fully compromised.
Technical Details
CVE-2024-37085 carries a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H, resulting in a medium base score of 6.8. The network attack vector (AV:N) reflects that the exploit is executed through Active Directory operations over the network. The low attack complexity (AC:L) indicates reliable exploitation once the prerequisites are met. High privileges (PR:H) are required, specifically the ability to create AD groups, which is typically associated with Domain Admin or delegated group management rights. User interaction (UI:R) is required in the attack chain.
The vulnerability exploits a design weakness in VMware ESXi's Active Directory authentication integration. When an ESXi host is joined to an AD domain, administrators can configure an AD security group whose members receive full ESXi administrative access. By default, this group is named "ESXi Admins." The critical flaw is that ESXi identifies this group by name rather than by its unique security identifier (SID). This means that if the original AD group is deleted, an attacker who can create AD groups can re-create a group with the same name, and ESXi will automatically grant full administrative access to the members of this newly created group. The attack sequence is: (1) identify the ESXi AD group name (often the default "ESXi Admins"), (2) delete the existing group or confirm it was previously deleted, (3) create a new AD group with the same name, (4) add the attacker's AD account to the group, and (5) authenticate to ESXi with full administrative privileges. Affected products include ESXi 7.0, ESXi 8.0, and VMware Cloud Foundation versions 4.0 through 5.1.x.
Frequently Asked Questions
What is CVE-2024-37085?
CVE-2024-37085 is an authentication bypass vulnerability in VMware ESXi that allows an attacker with Active Directory group creation privileges to gain full ESXi administrator access by re-creating a deleted AD group. It has a CVSS v3.1 score of 6.8 and a confirmed ransomware association.
Why is CVE-2024-37085 so dangerous despite a medium CVSS score?
The 6.8 CVSS score understates the real-world risk because ESXi hosts typically run many critical virtual machines. Compromising one ESXi host can take down an entire virtualized infrastructure. Combined with the confirmed ransomware association and EPSS score of 72.47%, this vulnerability poses an extreme operational risk to organizations using VMware infrastructure with AD integration.
How do ransomware groups exploit CVE-2024-37085?
Ransomware operators first compromise the Active Directory domain (often through other vulnerabilities or stolen credentials). With Domain Admin access, they re-create the "ESXi Admins" group, gain ESXi administrator access, and then deploy ESXi-specific ransomware that encrypts all VMDK files on the host, simultaneously taking down all virtual machines.
Does CVE-2024-37085 affect VMware vCenter Server?
CVE-2024-37085 specifically affects VMware ESXi hosts and VMware Cloud Foundation, not vCenter Server directly. However, compromising an ESXi host through this vulnerability can provide access to VMs managed by vCenter, effectively undermining the security of the entire vSphere environment.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.