Critical Authentication Bypass Vulnerability in VMware ESXi

What changed

VMware ESXi has been found to contain a significant authentication bypass vulnerability. This flaw enables a malicious actor with adequate Active Directory permissions to gain unauthorized access to an ESXi host.

The vulnerability arises when an attacker re-creates the Active Directory group used for user management, specifically the default 'ESXi Admins' group, after it has been deleted.

Who is affected

Several products and organizations could be impacted by this vulnerability, particularly those utilizing VMware ESXi for their cloud infrastructure.

The following groups are notably at risk:

• Organizations using VMware ESXi for cloud management.
• Enterprises that rely on Active Directory for user management.
• IT departments managing VMware Cloud Foundation.
• Any users with administrative roles in Active Directory linked to ESXi hosts.

What to do

It is crucial for affected organizations to assess their ESXi configurations and Active Directory settings to mitigate potential risks.

Regular audits and updates to user permissions and group configurations are recommended to prevent unauthorized access.

• Review Active Directory group configurations related to ESXi.
• Implement stricter access controls for Active Directory permissions.
• Monitor for any unauthorized changes to Active Directory groups.
• Stay informed about updates and patches from VMware addressing this vulnerability.