CVE-2024-37085: VMware ESXi AD group recreation authentication bypass

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is in CISA KEV with known ransomware use and high EPSS, but exploitation requires high AD privileges and a specific AD-joined configuration.

What it is

VMware ESXi contains an authentication bypass where an actor with sufficient Active Directory permissions can regain full access to an ESXi host joined to AD by recreating the configured AD group (default 'ESXi Admins') after it was deleted. The flaw is improper authentication (CWE-287/305) and matters because it undermines the assumption that removing the AD group revokes ESXi administrative access.

Impact

An attacker with the required AD permissions gains full administrative access to the affected ESXi host. This can lead to host compromise and, given ESXi's role, potential control over hosted workloads.

Attack surface

Reachable over the network (AV:N) with no user interaction (UI:N), but requires high privileges (PR:H) in Active Directory to recreate the group. The host must have been previously configured to use AD for user management.

Exploitation

CISA added it to KEV on 2024-07-30 with known ransomware campaign use, and EPSS 30-day probability is 0.2677 (97.9th percentile), indicating active exploitation in the wild.

What to do

• Apply the vendor patch from the Broadcom/VMware advisory for ESXi and Cloud Foundation.
• If patching is not immediately possible, follow CISA's required action to apply vendor mitigations or discontinue use of the product.
• Audit AD-joined ESXi hosts and restrict who can create or modify the configured ESXi admin group.
• Monitor for recreation of the ESXi admin group after deletion and alert on it.
• Consider removing ESXi hosts from AD or using a dedicated, tightly controlled AD group if AD integration is not required.

Detection

• Alert on creation or recreation of the configured ESXi admin AD group (default 'ESXi Admins') after deletion.
• Monitor ESXi host logs for new administrative logins or permission changes from AD users.
• Track AD changes to groups referenced by ESXi host AD integration configurations.
• Correlate ESXi authentication events with AD group modification events for the same host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.