VMware ESXi CVE-2024-37085 Targeted in Ransomware Campaigns

On Monday, July 29, Microsoft published an extensive threat intelligence blog on observed exploitation of CVE-2024-37085, an Active Directory integration authentication bypass vulnerability affecting Broadcom VMware ESXi hypervisors. The vulnerability, according to Redmond, was identified in...

CVE-2024-37085

creationtimestamp| type| source ---|---|--- 2024-06-28 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=1319 2024-07-29 20:58:17+00:00| exploited| https://t.me/informationsecuritychannel/52639 2024-07-30 00:00:05+00:00| seen| https://t.me/ctinow/220983 2024-07-30...

VMware ESXi 7.0 / 8.0 Authenticaton Bypass (CVE-2024-37085)

The version of VMware ESXi installed on the remote host is prior to 8.0 Update 3. It is, therefore, affected by an authentication bypass vulnerability as referenced in the VMSA-2024-0013 advisory. Note that Nessus has not tested for these issues but has instead relied only on the application's...

CVE-2024-37085

VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory AD permissions can gain full access to an ESXi host that was previously configured to use AD for user management...

VMSA-2024-0013:VMware ESXi and vCenter Server updates address multiple security vulnerabilities (CVE-2024-37085, CVE-2024-37086, CVE-2024-37087)

Advisory ID: | VMSA-2024-0013.2 ---|--- Advisory Severity: | Moderate CVSSv3 Range: | 5.3-6.8 Synopsis: | VMware ESXi and vCenter Server updates address multiple vulnerabilities CVE-2024-37085, CVE-2024-37086, CVE-2024-37087 Issue date: | 2024-06-25 Updated on: | 2024-08-12 CVEs | CVE-2024-37085,...

VulnCheck KEV: CVE-2024-37085

VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory AD permissions can gain full access to an ESXi host that was previously configured to use AD for user management by re-creating the configured AD group 'ESXi Admins' by default...