Exposed VMware ESXi logins and password spraying
The short version: A VMware ESXi management login exposed to the internet lets attackers quietly spray common and already-breached passwords across accounts until one works — and what's behind this door is the hypervisor running your virtual machines.
What you need to know
There's no CVE here and nothing to patch — the weakness is the combination of exposure and weak authentication on a system that should never face the internet. ESXi is a bare-metal hypervisor; its management interface controls every VM on the host. That interface belongs on a restricted management network, not the public internet.
- How they find it — routine internet-wide scanning and crawling surface exposed ESXi login interfaces.
- How they use it — automated, low-and-slow password spraying with common and previously-breached passwords, staying under lockout thresholds.
- What it leads to — a working credential can mean control of the hypervisor and every virtual machine on it. Internet-facing ESXi has been a repeated ransomware target precisely because compromising one host encrypts many systems at once.
How serious we see it
High. An ESXi management interface on the public internet is an exposure to eliminate, not merely to watch — the blast radius is every VM on the host, and it's a documented ransomware target. The severity eases only when the interface is restricted to a management network and every account is protected by MFA and strong, unique credentials. The reassuring part is that closing this is entirely in your hands — a network and access decision, with no vendor patch required.
What to do
- Get ESXi management off the public internet — restrict it to an isolated management network or require a VPN; this is the decisive fix.
- Enforce MFA and strong, unique credentials — and check them against known-breached lists.
- Enable lockout and monitor failed logins — ESXi supports account lockout; rate-limit and alert on spray patterns.
- Keep ESXi patched and hardened — follow VMware's security hardening guidance for management access.
- Confirm your exposure first — verify whether any ESXi login interface is reachable from the internet today.
How BreachRisk sees it
BreachRisk discovers ESXi login interfaces in your external footprint the way an attacker would — by crawling it — and then, where authorized, goes a step further than a scanner: it safely attempts a bounded, rate-limited authentication check using exposed (breach-corpus) and common credentials, within strict non-disruptive limits rather than a brute-force flood. That's the honest difference between detecting an exposed hypervisor login and demonstrating whether it actually holds — turning "we have ESXi on the internet" into a straight, prioritized finding to close.