Open Nav
Sign Up

Security Flaw in VMware’s Enhanced Authentication Plugin (EAP) Puts Active Directory at Risk

Bar Refael

February 21, 2024

VMware has issued an urgent advisory to uninstall the deprecated Enhanced Authentication Plugin (EAP) due to a critical security flaw identified as CVE-2024-22245 (CVSS score: 9.6). The vulnerability is an arbitrary authentication relay bug that could compromise Active Directory.

Vulnerability Details:

  • CVE ID: CVE-2024-22245
  • CVSS Score: 9.6 (Critical)
  • Affected Software: VMware Enhanced Authentication Plugin (EAP)
  • Impact: Arbitrary authentication relay, compromising Active Directory

Description:

The vulnerability allows a malicious actor to trick a target domain user with EAP installed in their web browser into requesting and relaying service tickets for arbitrary Active Directory Service Principal Names (SPNs). EAP, deprecated as of March 2021, is designed for direct login to vSphere’s management interfaces and tools through a web browser. A related session hijack flaw (CVE-2024-22250, CVSS score: 7.8) was also discovered, allowing a malicious actor with unprivileged local access to a Windows operating system to seize a privileged EAP session.

Mitigation Strategies:

  • Uninstall EAP: VMware recommends uninstalling the Enhanced Authentication Plugin altogether to mitigate potential threats. Use the client operating system’s method of uninstalling software to remove EAP from client systems.
  • Monitor for Suspicious Activity: Keep an eye on Active Directory logs for any unusual activity that may indicate exploitation attempts.
  • Regular Updates: Ensure that all VMware and other software are up to date with the latest security patches and updates.

Recommendations:

IT and security teams should take immediate action to uninstall the Enhanced Authentication Plugin from affected systems. Given the critical nature of the vulnerability and its potential impact on Active Directory, swift remediation is essential to maintain the security of the network and sensitive data.

Stay safe and informed,

OP Innovate Research Team.

Resources highlights

CISA: Attackers Exploiting SysAid Vulnerabilities (CVE-2025-2775, CVE-2025-2776)

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two SysAid On-Prem vulnerabilities, CVE-2025-2775 and CVE-2025-2776, to its Known Exploited Vulnerabilities (KEV) catalog, confirming…

Read more >

CVE-2025-2775, CVE-2025-2776

Critical Zero-Day in CrushFTP Exploited in the Wild (CVE-2025-54309)

A critical zero-day vulnerability in CrushFTP, CVE-2025-54309, is being actively exploited by threat actors to gain unauthenticated administrative access to vulnerable servers via HTTPS. The…

Read more >

CVE-2025-54309

Critical Zero-Day in Microsoft SharePoint Actively Exploited (CVE-2025-53770)

A newly discovered zero-day vulnerability in Microsoft SharePoint Server, tracked as CVE-2025-53770, is currently being exploited in active attacks against on-premises environments. The flaw, rated…

Read more >

CVE-2025-53770

Over 600 Laravel Applications Vulnerable to Remote Code Execution via Leaked APP_KEYs (CVE-2018-15133, CVE-2024-55556)

Security researchers have uncovered a major RCE threat affecting over 600 Laravel applications, triggered by leaked APP_KEYs found on public GitHub repositories. Laravel's APP_KEY, typically…

Read more >

CVE-2018-15133, CVE-2024-55556

CVE-2025-3648: “Count(er) Strike” Vulnerability in ServiceNow

CVE-2025-3648, dubbed “Count(er) Strike”, is a high-severity vulnerability (CVSS 8.2) in ServiceNow's Now Platform, discovered by Varonis Threat Labs. The flaw allows both authenticated and…

Read more >

CVE-2025-3648

What to Look for in a Pentesting Platform (Beyond Just Scans)

Penetration testing platforms are a great way to centralize vulnerability discovery and triage. However, when evaluating penetration testing platforms, many organizations make the mistake of…

Read more >

pentesting platform
Under Cyber Attack?

Fill out the form and we will contact you immediately.