CVE-2024-37085

Summary

CVE-2024-37085 is a vulnerability affecting VMware ESXi, an popular hypervisor for enterprise environments. The issue allows an attacker with sufficient Active Directory (AD) permissions to bypass authentication and gain unauthorized full access to an ESXi host. Previously, ESXi hosts were configured to use AD for user management (as outlined in VMware's blog post: <https://blogs.vmware.com/vsphere/2012/09/joining-vsphere-hosts-to-active-directory.html>). By recreating the configured AD group, 'ESXi Admins' by default, an attacker can exploit this vulnerability despite the group being deleted from AD.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.