CVE-2024-37085

The authentication bypass vulnerability in VMware ESXi represents a significant risk for organizations utilizing Active Directory (AD) for user management. This flaw allows a malicious actor with sufficient permissions within AD to gain unauthorized access to an ESXi host. The vulnerability arises when the configured AD group, typically 'ESXi Admins', is deleted and subsequently recreated. The system does not adequately validate the authenticity of the recreated group, thus allowing the attacker to exploit this oversight and assume control over the ESXi host. This situation highlights a critical weakness in the integration of VMware's virtualization platform with AD, particularly in how it handles group memberships and permissions.

Exploitation of this vulnerability can occur through various attack vectors. An attacker with the necessary AD permissions can delete the 'ESXi Admins' group and then recreate it, effectively granting themselves full administrative access to the ESXi host. This scenario could unfold in environments where AD is used extensively for user management, making it easier for an insider threat or a compromised account to exploit the vulnerability. Additionally, if the attacker has prior knowledge of the ESXi host's configuration and the permissions associated with the 'ESXi Admins' group, the likelihood of successful exploitation increases significantly. The ability to manipulate AD groups without proper oversight creates a pathway for unauthorized access, which can lead to further attacks within the virtualized infrastructure.

The real-world impact of this vulnerability is profound, particularly for organizations that rely on VMware ESXi for critical operations. Gaining administrative access to an ESXi host allows an attacker to manipulate virtual machines, access sensitive data, and potentially pivot to other systems within the network. This can lead to data breaches, service disruptions, and significant financial losses. Moreover, the reputational damage that accompanies such incidents can be detrimental, especially in industries where data integrity and security are paramount. The risk is exacerbated in environments where multiple ESXi hosts are managed, as a single compromised host can serve as a foothold for further attacks across the infrastructure.

To detect and mitigate this vulnerability, organizations should implement robust monitoring and logging of AD group changes, particularly those related to critical groups like 'ESXi Admins'. Regular audits of AD permissions and group memberships can help identify unauthorized changes and potential exploitation attempts. Additionally, organizations should enforce the principle of least privilege, ensuring that only necessary personnel have permissions to modify AD groups. Employing multi-factor authentication for accessing AD and ESXi hosts can also add an additional layer of security, making it more challenging for attackers to gain access even if they have compromised an account with sufficient permissions.

In conclusion, the authentication bypass vulnerability in VMware ESXi poses a serious threat to organizations leveraging AD for user management. The potential for exploitation by malicious actors with AD permissions highlights the need for stringent security measures and proactive monitoring. By understanding the technical details, potential attack vectors, and real-world implications of this vulnerability, organizations can better prepare themselves to defend against unauthorized access and protect their critical virtualized environments. Implementing effective detection and mitigation strategies will be essential in safeguarding against the risks associated with this vulnerability.

CSURFACE threat intelligence has identified a marked escalation in exploitation attempts targeting CVE-2024-37085, coinciding with the recent inclusion of this vulnerability in the KEV catalog and its confirmed use by multiple ransomware groups such as Akira and Blackbasta. While the EPSS score shows a slight decline, our telemetry indicates a sharp increase in detection activity, suggesting adversaries are actively leveraging new proof-of-concept exploits circulating on public repositories. This shift underscores an elevated risk to organizations relying on Active Directory-integrated VMware ESXi environments, as attackers with sufficient AD privileges can bypass authentication controls more readily. The convergence of ransomware campaigns exploiting this flaw amplifies the threat landscape, increasing the likelihood of impactful intrusions and data compromise. Consequently, the threat level for CVE-2024-37085 has intensified, warranting heightened vigilance despite the modest downward trend in EPSS metrics.

Update 2 — May 21, 2026

Recent updates to CVE-2024-37085 reveal a nuanced shift in the threat landscape. While our telemetry indicates a significant reduction in detection activity related to this vulnerability, the EPSS score has increased modestly, reflecting a slightly elevated likelihood of exploitation in the near term. This divergence suggests that although active exploitation attempts may have temporarily declined, the underlying risk remains persistent, particularly given the vulnerability’s inclusion in the KEV catalog with confirmed ransomware group associations such as Akira and Blackbasta. The presence of multiple proof-of-concept exploits on public repositories continues to lower the barrier for adversaries with sufficient Active Directory privileges to bypass authentication controls on VMware ESXi hosts. Consequently, defenders should recognize that despite a temporary lull in observable exploitation, the threat remains dynamic and capable of rapid resurgence. The updated CVSS score reduction to 6.8 does not materially diminish the operational risk, as the vulnerability’s exploitation potential is amplified by its integration into active ransomware campaigns. Overall, the threat level for CVE-2024-37085 remains elevated, warranting sustained vigilance and monitoring for shifts in attacker behavior.

Update 3 — June 09, 2026

Recent updates to CVE-2024-37085 reveal a moderate increase in its assessed severity, with the CVSS score rising from 6.8 to 7.2, accompanied by a corresponding uptick in the Exploit Prediction Scoring System (EPSS) score. CSURFACE threat intelligence notes this adjustment reflects growing confidence in the vulnerability’s exploitability and its integration into active ransomware campaigns, particularly those linked to groups such as Akira, BlackBasta, and BlackByte. Our telemetry indicates a steady upward trend in exploitation attempts, supported by the emergence of new proof-of-concept exploits publicly available on GitHub, which lower the barrier for adversaries to weaponize this flaw. This evolving landscape underscores the heightened operational risk posed by CVE-2024-37085, as attackers leverage its authentication bypass mechanism to gain full administrative control over VMware ESXi hosts configured with Active Directory. The increased EPSS score and ransomware associations signify that the vulnerability is not only theoretically exploitable but actively targeted in the wild, warranting elevated threat prioritization. Defenders should interpret these developments as a signal of sustained and potentially expanding adversary interest, reinforcing the need for continuous monitoring and rapid detection capabilities to identify exploitation attempts before they culminate in broader compromise.

Update 4 — July 07, 2026

CSURFACE threat intelligence has identified a marked escalation in exploitation attempts targeting CVE-2024-37085, with telemetry indicating a doubling in detection frequency over recent monitoring periods. This surge coincides with the emergence of new proof-of-concept exploits circulating on public repositories, which lower the technical barrier for adversaries to leverage the authentication bypass vulnerability on VMware ESXi hosts integrated with Active Directory. The persistence of ransomware groups such as Akira and Blackbasta in campaigns exploiting this flaw underscores its operational utility in post-compromise lateral movement and privilege escalation. Although the EPSS score remains stable, the qualitative increase in observed activity and expanded exploit availability elevate the practical risk of successful intrusions. For defenders, this development signals an intensified threat environment where opportunistic and sophisticated actors alike are more actively weaponizing this vulnerability, necessitating heightened vigilance in monitoring ESXi environments and associated Active Directory configurations.