CVE-2024-37085 Known ransomware use

VMware ESXi Authentication Bypass Vulnerability

VMware — ESXi

Added to KEV catalog: 30 July 2024
Federal remediation due date: 20 August 2024
Weakness classification (CWE): CWE-305

CISA Description

VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24505; https://nvd.nist.gov/vuln/detail/CVE-2024-37085

View on NVD View on MITRE CVE View full CISA catalog

More VMware Vulnerabilities

CVE-2025-22226

VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability

CVE-2025-22224

VMware ESXi and Workstation TOCTOU Race Condition Vulnerability

CVE-2025-22225

VMware ESXi Arbitrary Write Vulnerability

CVE-2024-38812

VMware vCenter Server Heap-Based Buffer Overflow Vulnerability

CVE-2024-38813

VMware vCenter Server Privilege Escalation Vulnerability

Confirm Your Exposure

Is this vulnerability present in your environment?

CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.

Explore VAPT Services