ESXi 6.5, 6.7, and 7.0 CVEs: What Is Unpatched — and What Will Never Be Patched

By Scott Bissett  ·  Published: August 12, 2026  ·  EOL Watch — security analysis  ·  CVE status verified against the live CISA KEV catalog (version 2026.08.11) and Broadcom advisories on August 12, 2026; lifecycle dates from our tracked data — methodology

If you searched "ESXi 6.5 CVE" or "ESXi 6.7 CVE," you are probably looking for a list of vulnerabilities to patch. Here is the honest version of that answer: on end-of-life ESXi, the CVE list is not your problem — the patch pipeline is. ESXi 6.5 and 6.7 both reached end of general support on October 15, 2022, and Broadcom's security advisories stopped evaluating them entirely. ESXi 7.0 is one step behind on the same road — past end of general support since October 2, 2025, and already carrying an actively-exploited, ransomware-abused vulnerability that Broadcom's own advisory matrix marks, in its own words, "No Patch Planned."

The pattern across the whole product line reduces to one sentence: the version you run determines whether a patch exists. ESXi 8.0 got the fix. ESXi 7.0 was told in writing it never would. ESXi 6.5 and 6.7 stopped even appearing in the advisories. This article walks that ladder rung by rung — every CISA-KEV-listed ESXi CVE verified against the live catalog, the ESXiArgs campaign that proved mass exploitation of old ESXi at scale, and the decision the dates force.

The 7.0 problem: an exploited CVE with "No Patch Planned" in the vendor's own matrix

CVE-2024-37085 is an authentication bypass in ESXi's Active Directory integration: a member of a domain group named ESX Admins gains full administrative access to the host. An attacker who can create or rename an AD group — or re-create one that was deleted — walks onto the hypervisor with full control. It was exploited in the wild by ransomware operators including Akira and Black Basta, and CISA added it to the Known Exploited Vulnerabilities catalog on July 30, 2024, with a federal remediation deadline of August 20, 2024. Broadcom (as CNA) scores it 6.8; NVD rates it 7.2 — another reminder that KEV listing, not CVSS, is the exploitation signal that matters.

The part that makes this CVE the centerpiece of any ESXi lifecycle discussion is in Broadcom's advisory VMSA-2024-0013. The response matrix lists ESXi 8.0 and 7.0 as affected. For 8.0, the fixed version is ESXi 8.0 Update 3 (build ESXi80U3-24022510). For 7.0, the fixed-version column reads "No Patch Planned." Not "patch pending," not "contact support" — a written statement that the 7.0 train would never receive a patched build, made while 7.0 was still inside its general-support window. The only mitigation offered for 7.0 is a manual Active Directory reconfiguration workaround. Then, on October 2, 2025, ESXi 7.0 reached end of general support — converting "No Patch Planned" from a vendor decision into a permanent condition. That is why this CVE sits in our Exploited & Unpatchable feed with ESXi 7.0 as a permanently vulnerable version.

Every KEV-listed ESXi CVE — and where a patch exists

We verified the following against the live CISA KEV catalog (version 2026.08.11, checked August 12, 2026). Six catalog entries name ESXi. Where a fixed build exists, its version tells you the story: fixes land only where the lifecycle clock is still running.

Read the fourth column top to bottom and the lifecycle pattern is unmistakable. The 2019 and 2020 CVEs have 6.5 and 6.7 builds because 6.x was still supported when they were disclosed. By 2024, the matrix had shrunk to 8.0-and-7.0, with 7.0 already being told no. By 2025, the matrix covered 7.0 and 8.0 only — 6.x doesn't appear as "affected" or "not affected"; it simply isn't evaluated. An absent row is not a clean bill of health. It means the vendor has stopped testing that version against new vulnerabilities, which is precisely the condition our CVE blind spot coverage describes: scanners see no CVEs against EOL versions because no one is filing them, not because none exist.

ESXiArgs: the proof that EOL ESXi gets exploited at scale

One vulnerability belongs in this article precisely because it is not in the KEV catalog — and we want to be exact about that distinction. CVE-2021-21974 is a heap overflow in ESXi's bundled OpenSLP service, reachable by anyone on the network segment with access to port 427, allowing remote code execution. It carries a CVSS score of 8.8 and was patched in February 2021 via VMSA-2021-0002 — fixed builds ESXi 7.0 U1c, ESXi670-202102401-SG for 6.7, and ESXi650-202102101-SG for 6.5. As of our verification pass on August 12, 2026, it does not appear in CISA's KEV catalog. That is a catalog-inclusion quirk, not an exploitation verdict — because what happened next is a matter of public record.

In February 2023 — two years after the patch shipped — the ESXiArgs ransomware campaign swept the internet-reachable ESXi population, encrypting VM configuration files on over 3,800 servers worldwide, per the joint CISA/FBI advisory AA23-039A. The event was severe enough that CISA published a dedicated recovery script (cisagov/ESXiArgs-Recover) to help victims reconstruct encrypted VMs. The compromised population was, by definition, machines that had not applied a two-year-old patch — and by February 2023, ESXi 6.5 and 6.7 had been past end of general support for months. ESXiArgs is the empirical answer to "who would even bother attacking my old hypervisor?": attackers scanned the entire internet for one old CVE on one product and monetized every hit they found, in bulk, over a weekend.

The lesson compounds with the previous section. For CVE-2021-21974 a patch existed and thousands of operators hadn't applied it. For everything disclosed after a version's end of support, there is no patch to apply — the ESXiArgs scenario, minus the option of having patched.

Every ESXi version's dates

All dates from our tracked ESXi lifecycle data, current as of the verification pass on August 12, 2026. VMware lifecycles have two milestones: end of general support (the end of security patches and bug fixes) and end of technical guidance (a self-help period afterward — guidance only, no new patches). Each version links to its lifecycle page with live status and risk score.

Our mirrored dates are re-verified nightly against the upstream endoflife.date dataset, whose cited sources trace to Broadcom's product lifecycle page. Note that ESXi 7.0 is currently inside its technical-guidance window (to April 2, 2027) — a phase that provides guidance only, not patches; the "No Patch Planned" entry for CVE-2024-37085 was written while 7.0 was still in general support. For the full version-by-version dates story, see our VMware ESXi end-of-life dates article — this page covers the CVE exposure side; that one covers the calendar.

The decision: 8.0, 9.x, or off the platform

For anyone on 6.5, 6.7, or 7.0, "harden and stay" is not a real branch — CVE-2024-37085 has no fix on 7.0 by the vendor's own statement, and 6.x is no longer evaluated at all. The real decision is the landing zone, and the dates above complicate it more than most upgrade guides admit:

ESXi 8.0 — the established target with a short runway. Released October 2022, it is the mature choice and the version that actually received the CVE-2024-37085 fix (land on 8.0 Update 3 or later). But its end of general support is October 11, 2027 — roughly 14 months out from this article. An upgrade project that takes two quarters to plan and execute would land you on a train with about a year of patches left. If you choose 8.0, schedule the 9.x move in the same planning document.

ESXi 9.x — the current trains, on visibly shorter clocks. ESXi 9.0 runs to September 17, 2027 — earlier than 8.0's date — and 9.1 to August 12, 2028. Compare that to the six years ESXi 6.5 got, and the shape of the Broadcom era is clear: support windows on this platform are shorter than the ones your last upgrade cycle was planned around. The broader packaging and licensing shifts under Broadcom are their own subject — covered in our VMware Cloud Foundation article — but the lifecycle math alone means upgrading ESXi is no longer a once-every-six-years event.

Migrating off — the only branch that ends the recurrence. For some estates, the honest response to a 7.0-or-6.x position in 2026 is not another ESXi version but a platform decision. That is a larger project than an in-place upgrade, and this article won't pretend to size it for you — but it is the only option that doesn't put the same decision back on your calendar in 24 months. Whatever the platform, the underlying dynamic is the same everywhere: end of life is inevitable, and the only variable you control is whether you meet it on a schedule you chose.

We track VMware ESXi and 480+ other products against vendor-verified dates — every ESXi version with live status, check any version in seconds, or see what else hits end of life this quarter.

Frequently Asked Questions

Related

• All VMware ESXi versions with live status · ESXi 7.0 — dates and risk score
• VMware ESXi End of Life — the full dates story, version by version
• Exploited & Unpatchable — the verified feed of KEV-listed vulnerabilities that end-of-life versions will never get fixes for, including ESXi CVE-2024-37085
• VMware Cloud Foundation End of Life — the Broadcom-era packaging and lifecycle shifts around ESXi
• Why End of Life Is Inevitable — the economics behind every "No Patch Planned"