VMware ESXi Vulnerability: What You Should Know

VMware ESXi is a bare-metal hypervisor: a single physical host running ESXi can simultaneously host many virtual machines, and in most enterprise environments it effectively runs the entire back-end infrastructure. A single ESXi host might be responsible for an organization's Active Directory domain controllers, Exchange mail servers, file servers, and any number of other business-critical virtual machines.

This centralization is exactly what makes ESXi such an attractive and high-impact target. Because the hypervisor sits underneath every guest virtual machine, compromising the hypervisor layer does not just compromise one server — it can compromise every virtual machine that host is running.

The vulnerability affects the ESXi hypervisor itself. When present and successfully exploited, it allows an attacker to impact every virtual machine residing on that hypervisor at once. In practice, successful exploitation has resulted in mass encryption of the virtual machine files backing those guest servers, followed by a shutdown of the affected systems — effectively a hypervisor-level ransomware event rather than an attack against an individual server or application.