Exploitation ongoing with high activity in latest observed window (2 mentions)
Recommended action window: Immediate (within 24h)
NVD description
VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management https://blogs.vmware.com/vsphere/2012/09/joining-vsphere-hosts-to-active-directory.html by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD.
Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2024-08-20. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Priority
MEDIUM
Exploitation
ACTIVE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
2 versions affected across 2 products
| Date | Total | Labels |
|---|
| 2026-06-15 | 1 | Active Exploitation1 |
| 2026-10-07 | 1 | Disclosure1 |
| 2026-10-09 | 2 | Active Exploitation1Disclosure1 |
IDCFの件まとめ 1．ESXi 6.7の脆弱性（CVE-2021-21974）を発見 2．ESXi 8.0.3の脆弱性（CVE-2024-37085）を発見 3．EOL状態の1からRCE（事前認証リモートコード実行） 3．または2（8.0系のAD連携バグ＝Admin自動取得） 4．IDCF王に俺はなる！（あとはやりたい放題） N-day攻撃で確定やないか😉
Post summary
The text announces the discovery of vulnerabilities in ESXi with CVE identifiers and technical details like remote code execution, but it does not mention PoC, exploit tools, patches, or confirmed active exploitation.
１年以上前に発見されてるが CVE-2024-37085 に正しく対処していない仮想化基盤が今週になって増えたランサムウェア被害のターゲットになっているのでは？ > Active DirectoryはESX Adminsというグループを作ると、そのメンバーにESXiの全権限を自動付与する https://www.ctc-g.co.jp/keys/blog/detail/ESXi-vulnerabilities
Post summary
CVE-2024-37085について、Active Directoryの「ESX Admins」グループに関する権限付与の挙動を説明しています。ランサムウェア被害との関連は疑問形の推測で、積極的な悪用の確証や修正情報は示されていません。
CVEs Explainer #11 CVE-2024-37085 (VMware ESXi Authentication Bypass) A high-severity flaw in VMware ESXi hypervisors that allowed attackers with sufficient Active Directory permissions to gain full administrative access by simply re-creating a deleted AD group (default: "ESXi Admins"). Microsoft researchers uncovered the vulnerability, which was actively exploited by ransomware groups to encrypt virtual machines at scale. It's a stark reminder that identity infrastructure misconfigurations can have catastrophic consequences.
Post summary
The text describes CVE-2024-37085 as an ESXi authentication bypass and reports that ransomware groups actively exploited it to encrypt virtual machines. No PoC, named exploit tool, or remediation is mentioned.
What to patch first, tied to this week's active groups: Fortinet CVE-2024-21762, CVE-2024-55591 (Qilin) SimpleHelp CVE-2024-57727 (DragonForce) VMware ESXi CVE-2024-37085 (Akira) Citrix CVE-2023-3519 (INC Ransom) Full report: https://scrutex.ai/blogs/weekly-ransomware-intelligence-report-june-14-2026 #ransomware #threatintel #CTEM
Post summary
The post alerts that a set of CVEs are currently exploited by active threat groups and urges immediate patching.
13 of 13 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | vmware | cloud_foundation | - | - | - |
| OS | vmware | esxi | 7.0 | - | - |
| OS | vmware | esxi | 8.0 | - | - |
| OS | vmware | esxi | 8.0 | - | - |
| OS | vmware | esxi | 8.0 | - | - |
| OS | vmware | esxi | 8.0 | - | - |
| OS | vmware | esxi | 8.0 | - | - |
| OS | vmware | esxi | 8.0 | - | - |
| OS | vmware | esxi | 8.0 | - | - |
| OS | vmware | esxi | 8.0 | - | - |
| OS | vmware | esxi | 8.0 | - | - |
| OS | vmware | esxi | 8.0 | - | - |
| OS | vmware | esxi | 8.0 | - | - |