VMware ESXi Authentication Bypass Vulnerability Identified

What changed

VMware has reported an authentication bypass vulnerability in its ESXi product. This flaw allows a malicious actor with sufficient Active Directory permissions to gain unauthorized access to an ESXi host that utilizes Active Directory for user management.

The vulnerability arises when an attacker recreates a previously deleted Active Directory group, typically named 'ESXi Admins', thereby circumventing the authentication mechanisms in place.

Who is affected

Organizations using VMware ESXi for virtualization and cloud infrastructure management are at risk, particularly those that integrate Active Directory for user management.

The following groups are particularly vulnerable:

• VMware ESXi users with Active Directory integration.
• Organizations relying on the default 'ESXi Admins' group for administrative access.
• IT departments managing cloud infrastructure with VMware Cloud Foundation.
• Any enterprise that has previously deleted the 'ESXi Admins' group from Active Directory.

What to do

It is crucial for affected organizations to assess their current Active Directory configurations and ensure that the 'ESXi Admins' group is not deleted or misconfigured.

Regular audits of group permissions and access controls should be implemented to mitigate potential exploitation of this vulnerability.

• Review Active Directory group configurations related to VMware ESXi.
• Recreate the 'ESXi Admins' group if it has been deleted to restore proper access controls.
• Monitor for any unauthorized access attempts to ESXi hosts.
• Stay updated with VMware's security advisories for any patches or further guidance.