CVE-2024-37085 is an authentication bypass vulnerability in VMware ESXi and Cloud Foundation. It allows an attacker with specific Active Directory permissions to gain full administrative access to an ESXi host by manipulating a configured AD group. This high-severity vulnerability (CVSS 7.2) is easily exploitable over the network with low attack complexity, leading to complete compromise of confidentiality, integrity, and availability. Critically, this CVE is actively exploited in the wild, including by ransomware groups like Scattered Spider and Black Basta, and has garnered significant community discussion and media attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 4.0, < 5.2CPE matchmatch criteria | cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:* | ||
7.0CPE matchmatch criteria | cpe:2.3:o:vmware:esxi:7.0:*:*:*:*:*:*:* | ||
8.0CPE matchmatch criteria | cpe:2.3:o:vmware:esxi:8.0:-:*:*:*:*:*:* | ||
8.0CPE matchmatch criteria | cpe:2.3:o:vmware:esxi:8.0:a:*:*:*:*:*:* | ||
8.0CPE matchmatch criteria | cpe:2.3:o:vmware:esxi:8.0:b:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.3 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.