VMware ESXi Authentication Bypass and Privilege Escalation via Active Directory Integration (CVE-2024-37085)
Executive & SecOps Summary
SECOPS ASSESSMENTVMware ESXi hosts configured to use Active Directory (AD) for user management.
A malicious actor with group creation permissions in AD can gain full administrative access to the ESXi host by re-creating the deleted 'ESXi Admins' group.
Apply the official security patches from Broadcom or change the default ESXi Admins group setting to an unprivileged/non-existent group name.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Apply the official security updates provided by Broadcom. You can update the ESXi host via the command line interface as follows:
# Place the ESXi host into maintenance mode
esxcli system maintenanceMode set --enable true
# Enable the HTTP client firewall rule for outbound connections
esxcli network firewall ruleset set -e true -r httpClient
# Update the ESXi host using the official Broadcom depot (adjust profile name as needed)
esxcli software profile update -p ESXi-8.0U3-24026615-standard -d https://hostupdates.vmware.com/software/VUM/PRODUCTION/main/vmw-depot-index.xml
# Reboot the host to apply changes
reboot
# (Post-reboot) esxcli system maintenanceMode set --enable false2. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, mitigate the risk by changing the default AD group that ESXi maps to administrative privileges to a non-existent or unprivileged group name.
# Change the default ESXi Admins group name to a dummy value to prevent unauthorized mapping
esxcli system settings advanced set -o /UserVars/EsxAdminsGroup -s 'DisabledAdminGroup_NoOneUseThis'
# Verify that the configuration change has been applied successfully
esxcli system settings advanced list -o /UserVars/EsxAdminsGroup3. Log Audit & IoC Verification Commands
Use the following PowerShell commands on an AD Domain Controller or management workstation to audit the creation history of the 'ESXi Admins' group.
# Retrieve the creation date and SID of the ESXi Admins group to detect unauthorized re-creation
Get-ADGroup -Identity 'ESXi Admins' -Properties WhenCreated, SID | Select-Object Name, WhenCreated, SID
# Audit Security Event Logs for group creation events (Event ID 4727) targeting 'ESXi Admins'
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4727} | Where-Object {$_.Message -like '*ESXi Admins*'} | Format-ListDetect Container Escape & Privilege Escalation Across Your Kubernetes Fleet
Continuous eBPF-based runtime threat detection and posture management for AWS, GCP, Azure, Docker, and Kubernetes workloads.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2024-37085) is an authentication bypass and privilege escalation flaw in VMware ESXi when integrated with Active Directory (AD) for user management. By default, ESXi automatically grants full administrative privileges to any member of the AD group named 'ESXi Admins'. However, a design flaw exists where ESXi does not validate the Security Identifier (SID) or the authenticity of the group; it relies solely on the group name. If the original group is deleted and re-created, ESXi blindly trusts the new group.
2. Exploitation Mechanics & Attack Scenario
An attacker with sufficient permissions to create groups in the AD domain can exploit this vulnerability. If the 'ESXi Admins' group does not exist or has been deleted, the attacker re-creates a group with the exact name 'ESXi Admins'. When the ESXi host synchronizes with the AD domain controller, it recognizes the group name and automatically maps root-level administrative privileges to any user account added to this newly created group, bypassing proper authentication controls.
3. Infrastructure & Business Impact
With a CVSS score of 7.2 (High) and its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog, this vulnerability is actively being exploited in the wild. Successful exploitation grants the attacker full control over the ESXi hypervisor. This allows them to compromise all hosted virtual machines, access sensitive data, deploy ransomware, and disrupt critical business infrastructure.
Official Vendor Advisories & References
VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management https://blogs.vmware.com/vsphere/2012/09/joining-vsphere-hosts-to-active-directory.html by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD.
Frequently Asked SecOps Questions (CVE-2024-37085)
FAQQ1. How critical is CVE-2024-37085 and is it actively exploited in the wild?
CVE-2024-37085 is rated CVSS 7.2 (HIGH) with a 30-day EPSS exploitation probability of 26.8%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2024-37085?
Primary impacted vendors include vmware, broadcom across esxi, vsphere. Scope summary: All supported versions of VMware ESXi configured with Active Directory integration prior to the official security patches
Q3. What temporary mitigations or workarounds exist for CVE-2024-37085 before patching?
[Mitigation] Apply the official security patches from Broadcom or change the default ESXi Admins group setting to an unprivileged/non-existent group name. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2024-37085
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (vmware)
View Category →VMware ESX Insufficient Logging Vulnerability (CVE-2026-41709) - Audit Bypass and Admin Activity Concealment
[Affected Scope] VMware ESX hypervisor environments.
VeloCloud Orchestrator (VCO) Privilege Escalation and Internal Access Vulnerability (CVE-2026-114625)
[Affected Scope] On-premise deployments of VeloCloud Orchestrator (VCO).
VMware vCenter Server Syslog Service Directory Traversal Remote Code Execution Vulnerability (CVE-2026-59310)
[Affected Scope] Systems running VMware vCenter Server with the built-in Syslog server service enabled.
Arista VeloCloud Orchestrator (VCO) On-Premises Remote Code Execution and Privilege Bypass (CVE-2026-16812)
[Affected Scope] On-premises deployments of VeloCloud Orchestrator (VCO)
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.