Detections
Analytics

2.2 (L1) Host must have all software updates installed

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Applying updates in a timely manner according to the severity of issues contributes greatly to the resilience of an environment. When applying updates, it is recommended to update vCenter Server first, if an update is available, and then proceed with updating ESXi. This sequence ensures that the management layer is updated before updating the ESXi hosts.

VMware publishes advisories on security vulnerabilities; for proactive notifications please subscribe to the mailing list at https://www.vmware.com/security/advisories.html

Issues in software that impact confidentiality, integrity, and/or availability can only be removed through patching to a version that resolves the issue. Threat actors exploit known vulnerabilities when attempting to gain unauthorized access or elevate privileges on an ESXi host.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Use VMware Lifecycle Manager to update and upgrade hosts when ESXi is managed through VMware vCenter. For standalone hosts use esxcli or API-driven methods for applying updates.

Employ a process to keep ESXi hosts up to date with patches in accordance with industry standards and internal guidelines. Leverage the VMware Lifecycle Manager to test and apply patches as they become available.

Impact:

ESXi servers must be in Maintenance Mode to apply patches. This implies all VMs must be moved or powered off on the ESXi server, so the patching process may necessitate brief outages. ESXi hosts that are compatible with Quick Boot may be able to greatly minimize the host restart time.

VMware vSphere Update releases add and change system functionality, whereas Patch releases only resolve issues.

See Also

https://workbench.cisecurity.org/benchmarks/21888

Item Details

Category: RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY

References: 800-53|RA-5, 800-53|SI-2, 800-53|SI-2(2), CSCv7|3.4

Plugin: VMware

Control ID: a353f36ee62b17e8e5dad2e9cd1d98b9d7436992bbc0572fcc07db5ba8b892c1