VMware ESXi authentication bypass (CVE-2024-37085) — matching on a name alone means recreating a deleted group lets you through
An authentication bypass in VMware ESXi. Where user management is delegated to a directory service, recreating the configured administrator group after it has been deleted is described as yielding full access to the host.
Key facts
- CVE IDCVE-2024-37085
- Affected (vendor / product)VMware ESXi
- CWECWE-305
- ExploitationListed in CISA KEV (exploitation confirmed); also confirmed used in ransomware
- Remediation due2024-08-20 (U.S. federal civilian agencies, BOD 22-01)
Key points
- The affected product is VMware ESXi, an authentication bypass classified under a weak primary authentication method.
- It presumes a configuration delegating user management to a directory service.
- Recreating the configured administrator group after deletion is described as yielding full access to the host.
- The issue lies less in how code was written than in a premise about how identity is established.
- Across the records this site holds as of 2026-09-04, virtualization entries with known ransomware use number 14.
1Deciding by name
Where user management is delegated to an external directory service, an arrangement says that whoever belongs to a given group is treated as an administrator. The question is what that correspondence is made on. Here, matching group names was enough to confer administrator status.
On the directory side, a group can be deleted and created again with the same name. To a person it looks the same; it is properly a different thing. Judging by name alone treats that different thing as the same one.
2Where the flaw sits
- 1PreconditionThe host is configured to delegate user management to a directory service
- 2RequirementSufficient permissions within that directory service
- 3ActionRecreating the configured administrator group after it was deleted
- 4ResultFull access to the host may be obtained
What stands out is that this is less an error in how code was written than a question about a premise in the design of authentication. The class covers cases where the method relied on to establish identity is not strong enough.
3Where virtualization sits
Virtualization stacks many virtual machines on one host. Taking the host affects everything running on it together. Across the records this site holds as of 2026-09-04, 14 unpublished entries in this grouping carry known ransomware use — fewer than boundary devices or business platforms, though the reach per entry tends to be wider.
4Questioning the premise
Applying an update is of course the remedy, but the entry points a step further back. On what basis is something judged to be the same party — a name, or an identifier that does not change? That choice exists in many systems, and made one way it invites the same confusion.
Why it matters
The choice of what establishes sameness exists across many systems, and matching on names invites confusion through recreation. Beyond applying updates, the method of correspondence itself is worth checking.
FAQ
Why does recreating a group work?
Why does virtualization amplify effects?
Sources (primary)
This article is an independent organization based on the U.S. official data below. Always verify the exact, latest details and applicability with the official and vendor sources.
- CISA KEV Catalog (known exploited list)
- NVD (CVE details / CVSS)
- Vendor / reference advisory
- This product uses data from the NVD API but is not endorsed or certified by the NVD. KEV data is CC0 (public domain).