VMware ESXi CVE-2024-37085 Active Directory 'ESX Admins' group authentication bypass used by ransomware (CISA KEV): which builds are fixed and what if ESXi 7.0 has no patch?

What it is: CVE-2024-37085 (VMware/Broadcom advisory VMSA-2024-0013, published 2024-06-25) is an authentication bypass in ESXi hosts that were configured to use Active Directory for user management. A malicious actor with sufficient AD permissions can gain full access to the host by re-creating the AD group configured for ESXi administration (named 'ESX Admins' by default) after it was deleted. The vendor rated it moderate (CVSS 6.8), but CISA added it to the KEV catalog on 2024-07-30 with known ransomware use, because AD-joined ESXi hosts are a common ransomware target and full host access means all VMs on it. Am I affected: - ESXi hosts joined to Active Directory (check Host > Manage > Security & users > Authentication services, or the Host Client). Hosts not using AD for authentication are not exposed to this path. - Broadcom's response matrix: ESXi 8.0 is fixed in ESXi80U3-24022510. ESXi 7.0 is listed as No Patch Planned for this CVE. VMware Cloud Foundation 5.x is fixed in 5.2; VCF 4.x has no patch planned. The in-product workaround is described in KB369707. Fix: 1. Patch ESXi 8.0 to the fixed build or a later one. Where no patch is planned (ESXi 7.0, VCF 4.x), apply the workaround from KB369707 and plan an upgrade to a supported release. 2. Reduce reliance on the default group name and on broad AD rights: review who can create or modify groups in the OU and domain, restrict that to a small admin set, and consider removing AD authentication from hosts that do not need it, using vCenter/identity federation with controlled roles instead. 3. Monitor for group creation or changes matching the ESXi admin group name in AD, for new AD admin-role assignments on hosts, and for unusual host logins or SSH being enabled. 4. If you suspect abuse: review AD audit logs and ESXi authentication logs (hostd, auth) for the period, check for unknown local users, enabled SSH/shell and unexpected VIBs or configuration changes, isolate affected hosts, and rotate root and service credentials. Verify backups are offline and unmodified before restoring. Verify: the ESXi build number matches the fixed build (or the KB369707 workaround is applied on unpatched releases), and only an approved small group can create or edit the ESXi admin AD group. Sources: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24505 https://nvd.nist.gov/vuln/detail/CVE-2024-37085 https://www.cisa.gov/known-exploited-vulnerabilities-catalog