Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV N L H R U H H H 6.8 .2677 98.0 YES
AFFECTED Product Versions Fixed VMware ESXi 8.0 – — VMware Cloud Foundation 5.x – —
TIMELINE Jun 3 Reserved by vmware Jun 25 Published (CNA: vmware) Jul 30 Added to CISA KEV, remediation due 2024-08-20
VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management https://blogs.vmware.com/vsphere/2012/09/joining-vsphere-hosts-to-active-directory.html by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD.
| Date | Event | Detail |
|---|---|---|
| June 3, 2024 | Reserved | Reserved by vmware |
| June 25, 2024 | Published | Published (CNA: vmware) |
| July 30, 2024 | KEV ADDED | Added to CISA KEV, remediation due 2024-08-20 |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| n/a | VMware ESXi | — | 8.0 | — |
| n/a | VMware Cloud Foundation | — | 5.x | — |
Authoritative record: CVE-2024-37085 at cve.org
Weaknesses: CWE-305
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2024-37085 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
