“ESXi hypervisors do not validate that such a group exists when the server is joined to a domain.”
CVE-2024-37085 means a domain-joined ESXi host hands full admin rights to any domain group named “ESX Admins.” The group doesn’t exist by default, so an attacker creates it and adds themselves. Storm-0506 used it to deploy Black Basta at a North American engineering firm. Microsoft’s incident response cases involving ESXi have more than doubled in three years. The hypervisor’s access control is a string match on a group name.