Vulnerability Database

300,445

Total vulnerabilities in the database

CVE-2024-37085

VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management https://blogs.vmware.com/vsphere/2012/09/joining-vsphere-hosts-to-active-directory.html by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD.

  • Published: Jun 25, 2024
  • Updated: Nov 4, 2025
  • CVE: CVE-2024-37085
  • Severity: Medium
  • Exploit:

CVSS v3:

  • Severity: Medium
  • Score: 6.8
  • AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

CWEs:

OWASP TOP 10:

Software From Fixed in
vmware / esxi 8.0 8.0.x
vmware / esxi 7.0 7.0.x
vmware / esxi 8.0-update_2c 8.0-update_2c.x
vmware / esxi 8.0-update_1d 8.0-update_1d.x
vmware / esxi 8.0-update_2b 8.0-update_2b.x
vmware / esxi 8.0-update_2 8.0-update_2.x
vmware / esxi 8.0-update_1c 8.0-update_1c.x
vmware / esxi 8.0-update_1a 8.0-update_1a.x
vmware / esxi 8.0-update_1 8.0-update_1.x
vmware / esxi 8.0-c 8.0-c.x
vmware / esxi 8.0-b 8.0-b.x
vmware / esxi 8.0-a 8.0-a.x
vmware / cloud_foundation 4.0 5.2