VMware ESX / ESXi Unsupported Version Detection

Tenable plugin 56997 is not a CVE. It is a *lifecycle detection* — Nessus fingerprints the ESX/ESXi build number and compares it against Broadcom/VMware's supported product matrix. If the build is past General Support or Technical Guidance end date, the plugin fires. Historically this covers ESX 3.x/4.x, ESXi 5.x, ESXi 6.0/6.5/6.7, and now ESXi 7.0 as its EoGS window closes in October 2027 for most SKUs. The finding says nothing about a specific unpatched vulnerability; it says the platform will *never again* receive one.

The vendor severity of CRITICAL / CVSS 10.0 is Tenable's editorial choice, not a computed exploitability score. It reflects the reality that an unsupported hypervisor accumulates unfixed CVEs indefinitely (see the ESXiArgs ransomware campaign against EoL ESXi 6.5/6.7 in 2023, and the CVE-2024-37085 AD-integration bypass abused by Storm-0506/Black Basta). The label overstates *immediate* exploitability but understates *strategic* risk. Real severity is HIGH — you are not being popped today because of this finding, but every future ESXi CVE is now your permanent problem.

Why this verdict

• Not a CVE: plugin 56997 is a lifecycle marker; there is no single exploit chain that fires *because* of this finding. That alone argues against literal CRITICAL.
• Role multiplier — hypervisor: ESXi is canonically a high-value role. A single successful RCE from any accumulated EoL CVE ends in encryption/exfil of every guest on the datastore. Chain succeeds in the (b) typical role AND the (c) high-value role — floor is HIGH.
• Installed-base exposure: Shodan shows ~40k publicly reachable ESXi hosts; Censys shows ~28k still on 6.x. Non-trivial share sits in the exposed high-value bucket, sustaining the floor.
• KEV proximity: four ESXi CVEs are KEV-listed and actively used by ransomware crews (Black Basta, Akira, LockBit ESXi). An EoL host is a permanent target for these campaigns.
• Friction against literal CRITICAL: most enterprises firewall the management VLAN; direct ESXi/443 from the Internet is rare. This is the reason the verdict lands at HIGH rather than being escalated to CRITICAL.

Why not higher?

The finding itself does not correspond to a live, unauthenticated, network-reachable RCE at scan time. In well-segmented environments the ESXi management interface is not routable from user or Internet networks, so exploitation requires a prior foothold. Absent evidence the specific host is externally exposed or AD-joined with ESX Admins present, CRITICAL overstates immediacy.

Why not lower?

Downgrading to MEDIUM would ignore the deployment-role floor. A hypervisor with no future patches is a strategic ransomware magnet — every ESXi encryptor campaign of the last three years has targeted exactly this population. Role multiplier + KEV-linked downstream CVEs + turnkey PoCs mean HIGH is the lowest defensible bucket.

1. Isolate ESXi management to a dedicated VLAN with jump-host-only access — Blocks step 1 and step 2 network reach. Deploy within 30 days per the noisgate HIGH mitigation SLA. Enforce with L3 ACLs; deny 443/902/5988/5989 from user and server VLANs.
2. Disable SLP and CIM on every EoL host — esxcli system slp set --enable=false; /etc/init.d/slpd stop; chkconfig slpd off. Kills the OpenSLP CVE chain (CVE-2021-21974, CVE-2020-3992) that ESXiArgs weaponized. Deploy within 3 days as a stopgap even though verdict is HIGH — SLP RCE is trivial once reachable.
3. Enable Lockdown Mode (Normal or Strict) and enforce Secure Boot where hardware supports it — Removes direct root-over-SSH and blocks unsigned VIB persistence. Roll into the 30-day mitigation window.
4. Remove or rename the ESX Admins AD group and enforce explicit host permissions — Kills CVE-2024-37085 auth bypass regardless of build. Do this within a week — the AD group name is the entire trigger condition.
5. Verify immutable/air-gapped backups of every VM on affected datastores — Assumes encryption *will* happen. Test restore of one production VM. Complete within 30 days.
6. Schedule migration to ESXi 8.0 U3 (or Nutanix AHV, Proxmox, Hyper-V if Broadcom licensing is the blocker) — This is the remediation, not a mitigation. Target ≤180 days per noisgate HIGH remediation SLA; ≤90 days if any host is externally reachable.

Run from a Linux auditor workstation with sshpass and read-only ESXi credentials, or from vCenter's appliance shell. Example: ./check_esxi_eol.sh esxi01.corp.local root. Requires SSH enabled temporarily or PowerCLI equivalent; the script exits 0 for PATCHED (supported build), 1 for VULNERABLE (EoL), 2 for UNKNOWN.

#!/usr/bin/env bash
# noisgate — Tenable 56997 verification
# Determines whether an ESXi host is on a supported build.
set -u
HOST="${1:-}"
USER="${2:-root}"
if [ -z "$HOST" ]; then echo "usage: $0 <esxi-host> [user]" >&2; exit 2; fi

# Pull build info via SSH; adjust to PowerCLI Get-VMHost if SSH is disabled.
BUILD=$(ssh -o StrictHostKeyChecking=no -o ConnectTimeout=8 "$USER@$HOST" \
  "vmware -v; vmware -l" 2>/dev/null)

if [ -z "$BUILD" ]; then
  echo "UNKNOWN: could not retrieve build from $HOST"
  exit 2
fi

echo "$BUILD"

# Supported as of 2026-07-10: ESXi 8.0 (any U), ESXi 7.0 (through 2027-10-02 Technical Guidance)
if echo "$BUILD" | grep -Eq 'VMware ESXi 8\.0'; then
  echo "PATCHED: ESXi 8.0 in General Support"
  exit 0
fi

if echo "$BUILD" | grep -Eq 'VMware ESXi 7\.0'; then
  # 7.0 EoGS was 2025-04-02; now in Technical Guidance until 2027-10-02 — no new security patches.
  echo "VULNERABLE: ESXi 7.0 past End of General Support (2025-04-02); Technical Guidance only, no security patches"
  exit 1
fi

if echo "$BUILD" | grep -Eq 'VMware ESXi (6\.[057]|5\.[015]|4\.|3\.)'; then
  echo "VULNERABLE: EoL ESXi build detected — flagged by Tenable 56997"
  exit 1
fi

echo "UNKNOWN: unrecognized build string"
exit 2

Sources

1. Tenable plugin 56997
2. Broadcom VMware Product Lifecycle Matrix
3. CISA KEV — CVE-2021-21974 (ESXi OpenSLP)
4. Microsoft Threat Intelligence — CVE-2024-37085 ESXi auth bypass abused by ransomware operators
5. CERT-FR ESXiArgs advisory
6. VMware KB 76372 — disabling SLP on ESXi
7. Broadcom ESXi 7.0 EoGS notice
8. Rapid7 Metasploit vmware_openslp_rce module