Critical VMware ESXi Zero-Day CVE-2024-37085 Exploited by Ransomware Groups for Full Host Access

Executive Summary

On July 29, 2026, Microsoft Threat Intelligence (MSTIC) published a comprehensive analysis of active, in-the-wild exploitation of a significant authentication bypass vulnerability in VMware ESXi, tracked as CVE-2024-37085. This vulnerability allows threat actors with existing low-level Active Directory (AD) permissions to escalate their privileges to full administrative control over domain-joined ESXi hypervisors. Recent incident response engagements have confirmed that at least three distinct ransomware operations—Storm-0506, Storm-1175, and Octo Tempest—have successfully leveraged this flaw to facilitate the deployment of Akira and Black Basta ransomware across enterprise virtualized environments.

Threat Analysis

The vulnerability is particularly dangerous because it targets the infrastructure layer rather than individual endpoints. By compromising the ESXi hypervisor, attackers gain the ability to manage or encrypt all virtual machines (VMs) hosted on that server, effectively bypassing most operating-system-level security controls. MSTIC observations indicate that threat actors are shifting their focus from broad scanning to high-impact privilege escalation within already-compromised networks. In several documented cases, the exploitation of CVE-2024-37085 served as the final step in an attack chain that began with initial access via Qakbot or IcedID, followed by lateral movement to the domain controller.

Technical Details

CVE-2024-37085 stems from a logic flaw in how VMware ESXi handles Active Directory integration. By default, ESXi hypervisors joined to a domain grant full administrative access to any member of a domain group named "ESX Admins." However, the hypervisor does not properly validate the origin or integrity of this group during the authentication process.

Attackers utilize three primary methods of exploitation:

1. Group Creation: If the "ESX Admins" group does not exist in the AD forest, an attacker with sufficient permissions to create groups can simply create it and add their compromised account to gain immediate VIM Admin privileges on all domain-joined ESXi hosts.
2. Group Renaming: An attacker can rename an existing group that they already control to "ESX Admins," achieving the same result.
3. Privilege Persistence: Even if administrators change the default management group, the "ESX Admins" group often retains legacy permissions due to an incomplete privileges refresh logic in older ESXi versions.

Attribution Assessment

MSTIC attributes this activity with high confidence to a variety of financially motivated cybercriminal groups. Specifically, Storm-0506 (a known Black Basta affiliate) has been observed using this method against North American engineering and financial firms. Additionally, the Octo Tempest group, known for its aggressive social engineering and multi-extortion tactics, has integrated this ESXi bypass into their playbook to accelerate the encryption phase of their operations. There is currently no evidence of nation-state involvement, though the technique's effectiveness makes it a likely candidate for future espionage campaigns.

Implications

The exploitation of hypervisors represents a critical failure point for modern data centers. Once an actor gains administrative access to the ESXi host, they can disable security logs, delete snapshots, and encrypt the underlying datastores. This makes recovery significantly more difficult than traditional file-based encryption on guest VMs. The widespread use of default configurations for AD-joined ESXi hosts means the attack surface for CVE-2024-37085 is vast, affecting thousands of organizations globally.

Recommendations

1. Patch Management: Immediately update ESXi hosts to version 8.0 U3 or the latest available security patches that address CVE-2024-37085.
2. Audit AD Groups: Conduct an urgent audit of Active Directory to ensure no unauthorized "ESX Admins" or "ESXi Admins" groups exist. Monitor for any attempts to create or rename groups with these strings.
3. Restrict Permissions: Limit the number of users capable of creating or modifying domain groups. Implement a 'least privilege' model for AD accounts used for hypervisor management.
4. Host Hardening: If patching is delayed, follow VMware's workaround to change the Config.HostAgent.plugins.hostsvc.esxAdminsGroup setting to a non-default, hardened group name.