What is the CVSS score of CVE-2024-37085?

CVE-2024-37085 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 74.8%.

Which versions of VMware ESXi are affected by CVE-2024-37085?

Organizations using VMware ESXi should be aware of notable risk from CVE-2024-37085, a improper authentication vulnerability rated CVSS 6.8.. A patch is available.

Is CVE-2024-37085 being actively exploited?

Yes, CVE-2024-37085 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, confirming active in-the-wild exploitation. Immediate patching is required.

How to fix or mitigate CVE-2024-37085?

Within 24 hours: Identify affected systems and apply vendor patches immediately. Audit authentication configurations.

VMware ESXi CVE-2024-37085

MEDIUM

Improper Authentication (CWE-287)

2024-06-25 security@vmware.com

6.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.8 MEDIUM

AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 26, 2026 - 11:20 vuln.today

Added to CISA KEV

Oct 30, 2025 - 19:52 cisa

CISA KEV

Patch released

Oct 30, 2025 - 19:52 nvd

Patch available

CVE Published

Jun 25, 2024 - 15:15 nvd

MEDIUM 6.8

DescriptionCVE.org

VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management https://blogs.vmware.com/vsphere/2012/09/joining-vsphere-hosts-to-active-directory.html by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD.

AnalysisAI

VMware ESXi contains an authentication bypass vulnerability.

Technical ContextAI

An authentication bypass vulnerability allows attackers to circumvent login mechanisms and gain unauthorized access without valid credentials. This vulnerability is classified as Improper Authentication (CWE-287).

RemediationAI

A vendor patch is available — apply it immediately. Implement robust authentication mechanisms. Use multi-factor authentication. Review authentication logic for bypass conditions. Remove default credentials.