CVE-2024-37085
CVE-2024-37085
This page contains facts from public vulnerability sources. Check the original advisory before updating.
VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management https://blogs.vmware.com/vsphere/2012/09/joining-vsphere-hosts-to-active-directory.html by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD.
CVSS 6.8 · Medium · EPSS 26.8% · In KEV · Public exploit
- Published
- Updated
Affected products and versions
vmware esxi
- Versions
- ≥ 8.0, < ESXi80U3-24022510: Affected (custom)
- 7.0: Affected
No fix published
vmware cloud foundation
- Versions
- 5.x: Affected
- 4.x: Affected
No fix published