Authentication Bypass in VMware ESXi (CVE‑2024‑37085) Threatens Hypervisor Access via AD Integration
What It Is — VMware ESXi contains an authentication‑bypass flaw that lets an attacker who can manipulate Active Directory recreate the “ESXi Admins” AD group (or a custom‑named equivalent) after it has been deleted, thereby gaining full host access without further credentials.
Exploitability — The vulnerability is exploitable by any adversary with sufficient AD permissions; a public proof‑of‑concept exists. The CVSS base score is 9.8 (Critical).
Affected Products — VMware ESXi (all versions that support AD authentication).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for robust privileged‑access controls that extend to external identity providers.
- Highlights gaps in continuous monitoring of identity‑source changes—a core evidence point for audit readiness.
- A successful bypass erodes the defensible audit trail that enterprises rely on to prove compliance with access‑control objectives across frameworks (e.g., NIST CSF, ISO 27001).
Recommended Actions
- Apply VMware’s latest security patch for CVE‑2024‑37085 immediately.
- Review and harden AD group permissions; enforce least‑privilege for any group used by ESXi.
- Enable multi‑factor authentication for AD admin accounts and log all group‑creation events.
- Deploy continuous monitoring of AD changes and ESXi host authentication logs to capture any unauthorized group recreation.
- Validate that your privileged‑access management (PAM) solution can enforce separation of duties for hypervisor administration.
Source: CISA KEV – CVE‑2024‑37085