The Cybersecurity and Infrastructure Security Agency (CISA) has mandated U.S. Federal Civilian Executive Branch (FCEB) agencies to secure their systems against a VMware ESXi authentication bypass vulnerability which ransomware operators have been exploiting to gain full administrative access and encrypt file systems. Discovered by Microsoft and fixed by Broadcom’s VMware on June 25, 2024, the vulnerability, tracked as CVE-2024-37085, allows attackers to create or rename a group to “ESX Admins,” granting administrative privileges on the ESXi hypervisor. Despite being rated medium-severity and requiring high privileges for exploitation, ransomware groups like Storm-0506 and others have used it to exfiltrate data and disrupt operations by encrypting multiple virtual machines (VMs) simultaneously. Following Microsoft’s report, CISA added the flaw to its ‘Known Exploited Vulnerabilities (KEV) catalog, giving FCEB agencies until August 20, 2024, to secure their systems. While the directive specifically targets federal agencies, CISA advises all organizations to address this vulnerability. CTIX analysts strongly urge administrators to upgrade to ESXi 8.0 Update 3 and monitor for unauthorized changes to the ESX Admins group to prevent future ransomware attacks targeting their networks.