ESXi 5

Plugin 81085 flags any ESXi 5.5 host at a build below 2352327 (January 2015 patch level) as vulnerable to a bundle of seven CVEs, dominated by POODLE (CVE-2014-3566), a handful of OpenSSL companion bugs (CVE-2014-3513, -3567, -3568), a libxml2 entity-expansion DoS (CVE-2014-3660), and a vmware-authd DoS (CVE-2014-8370). The most notable is CVE-2015-1044, an information-disclosure flaw in the ESXi authentication handling. Fix is patch bundles ESXi550-201403102-SG and ESXi550-201501101-SG, which by 2026 are ancient.

Tenable calls this HIGH (CVSSv2 8.1). Vendor listing you were shown as MEDIUM undersells reality: the underlying CVEs are individually medium-grade (mostly SSL/TLS MitM and DoS), but the *host* still failing this check in 2026 is running ESXi 5.5, which reached General Support end-of-life on 19 Sep 2018 and Technical Guidance EOL on 19 Sep 2020. There are no more patches, no more advisories, and every VMSA published since — including the 2024–2025 hypervisor escape wave — is unaddressable. MEDIUM is wrong. HIGH is right, and the reason isn't POODLE.

Why this verdict

• Role multiplier — hypervisor: Any successful chain on ESXi ends in *every VM on that host* being compromised, and pivoting to vCenter turns it into a datacenter event. Per the noisgate hard rule, a canonical hypervisor deployment floors the verdict at HIGH minimum.
• EOL amplifier: ESXi 5.5 lost Technical Guidance in Sep 2020. A host still failing this 2015 check has missed every VMSA since — including CVE-2021-21974 (ESXiArgs), CVE-2023-20867, CVE-2023-34048, and the 2025 hypervisor-escape wave. Plugin 81085 is a proxy for *systemic* unpatchability, not just POODLE.
• Friction on the individual 2014 CVEs pulls DOWN: POODLE requires an active MitM plus an SSLv3-speaking client, which basically doesn't exist in 2026. libxml2 and vmware-authd bugs are DoS-only. If this were a supported version, MEDIUM would be defensible.
• Net: floor of HIGH from hypervisor role + EOL exposure, not lifted to CRITICAL because the *named CVEs in the plugin* are not directly RCE and the exploit population that reaches the mgmt VLAN is bounded.

Why not higher?

The seven CVEs specifically flagged by plugin 81085 are POODLE-class MitM and DoS bugs — not remote unauthenticated RCE. CRITICAL requires a directly weaponizable chain on the flagged CVEs; the CRITICAL story here belongs to downstream VMSAs the host is separately vulnerable to, and those have their own plugins.

Why not lower?

MEDIUM assumes the host will be patched. It cannot be — 5.5 has been out of support since 2020. Any hypervisor that has drifted this far behind is a fleet-scale risk regardless of which single CVE lights up the scanner, and treating it as MEDIUM lets it sit in the 365-day backlog when it should be on a decommission plan measured in weeks.

1. Decommission or migrate every ESXi 5.5 host within 30 days — There is no supported patch path. Migrate VMs to ESXi 7.0 U3 or 8.0 U3 (or a KVM/Proxmox target if licensing forces it). Per the noisgate HIGH mitigation SLA, this is the only real remediation.
2. Isolate ESXi mgmt interfaces to a dedicated VLAN, ACL-restricted to jump hosts — Blocks the network reachability precondition for every step in the chain — POODLE, DoS, and the downstream VMSAs the host is now defenseless against. Deploy today; the noisgate mitigation SLA of 30 days for HIGH assumes this is the interim control.
3. Disable SSLv3 on any remaining ESXi 5.5 hosts — Set UserVars.ESXiVPsDisabledProtocols to include sslv3 in /etc/vmware/rhttpproxy/config.xml and restart rhttpproxy. Kills the POODLE path specifically.
4. Verify no internet exposure via external attack-surface tooling — Query Censys / Shodan / your ASM tool for vmware + 443 on your ASN ranges. Any 5.5 host reachable from the internet is a P0 — pull it offline within 24 hours.
5. Snapshot and export every VM on the affected hosts — Assume compromise possibility during the migration window. Full offline backup before you kick off vMotion or a cold migration.

Run on an auditor workstation with SSH or esxcli reachability to the target ESXi host. Invoke as ./check_esxi_81085.sh <esxi-host>; needs an ESXi account with Host.Config.Settings or root SSH. Reports VULNERABLE if build < 2352327 OR the host is any 5.5 release (which is EOL).

#!/usr/bin/env bash
# noisgate verification — tenable:81085
# Detects ESXi 5.5 hosts below build 2352327 AND flags any 5.5 host as EOL.
set -u
HOST="${1:-}"
if [[ -z "$HOST" ]]; then
  echo "Usage: $0 <esxi-host-or-ip>"; exit 2
fi

THRESHOLD=2352327

# Try SSH (esxcli) first; fall back to remote banner grab over HTTPS.
get_via_ssh() {
  ssh -o BatchMode=yes -o ConnectTimeout=5 root@"$HOST" \
    'vmware -v; echo ---; esxcli system version get' 2>/dev/null
}

get_via_https() {
  # ESXi exposes build info in the /sdk endpoint response headers and
  # the /client/clients.xml file on many builds.
  curl -sk --max-time 8 "https://$HOST/sdk" -X POST \
    -H 'Content-Type: text/xml' \
    --data '<?xml version="1.0"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><RetrieveServiceContent xmlns="urn:vim25"><_this type="ServiceInstance">ServiceInstance</_this></RetrieveServiceContent></soap:Body></soap:Envelope>'
}

OUT="$(get_via_ssh)"
if [[ -z "$OUT" ]]; then
  OUT="$(get_via_https)"
fi

if [[ -z "$OUT" ]]; then
  echo "UNKNOWN: could not reach $HOST via SSH or HTTPS"; exit 3
fi

VERSION="$(echo "$OUT" | grep -oE 'VMware ESXi [0-9]+\.[0-9]+\.[0-9]+' | head -1)"
BUILD="$(echo "$OUT" | grep -oE 'build[- ]?[0-9]+' | grep -oE '[0-9]+' | head -1)"

if [[ -z "$VERSION" || -z "$BUILD" ]]; then
  echo "UNKNOWN: could not parse version/build from response"; exit 3
fi

echo "Detected: $VERSION build $BUILD"

# Anything 5.5 is EOL — always VULNERABLE per noisgate reassessment.
if echo "$VERSION" | grep -q 'ESXi 5\.5'; then
  if [[ "$BUILD" -lt "$THRESHOLD" ]]; then
    echo "VULNERABLE: ESXi 5.5 build $BUILD < $THRESHOLD (plugin 81085) AND version is EOL"
  else
    echo "VULNERABLE: ESXi 5.5 is EOL since 2020-09-19 — no patches available for downstream VMSAs"
  fi
  exit 1
fi

echo "PATCHED: host is not ESXi 5.5"
exit 0

Sources

1. Tenable plugin 81085
2. VMSA-2014-0012 (POODLE/OpenSSL in ESXi)
3. VMSA-2015-0001 (ESXi 5.5 patch)
4. VMware ESXi lifecycle / EOL matrix
5. CVE-2014-3566 (POODLE) - NVD
6. CVE-2015-1044 - NVD
7. CISA KEV — CVE-2021-21974 (ESXiArgs, unpatchable on 5.5)
8. VMSA-2025-0010 (Broadcom)