Official VMware security advisory or update

Broadcom's VMware ESXi Vulnerability Allows Hackers Admin Control Despite 'Moderate' Severity Rating

Jul 29, 2024, 09:26 PM

A recently discovered vulnerability in VMware's ESXi hypervisor allows hackers to gain hypervisor admin control by simply creating an Active Directory (AD) group named 'ESX Admins'. This issue, which VMware has classified as 'moderate' severity, is being actively exploited by ransomware threat actors. The vulnerability is particularly concerning because the right to create such a group is often delegated to many IT personnel or even all users within a company through platforms like Microsoft Identity Manager (MIM). Despite the serious implications, VMware's classification of the vulnerability has raised concerns among cybersecurity experts. Broadcom, the parent company of VMware, has yet to address these concerns.