STIGQter STIGQter: STIG Summary: VMware vSphere 8.0 ESXi Security Technical Implementation Guide Version: 2 Release: 4 Benchmark Date: 01 Jul 2026:

The ESXi host must enforce the exclusive running of executables from approved VIBs.

DISA Rule

SV-258798r959010_rule

Vulnerability Number

V-258798

Group Title

SRG-OS-000480-VMM-002000

Rule Version

ESXI-80-000244

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

From the vSphere Client, go to Hosts and Clusters.

Select the ESXi Host >> Configure >> System >> Advanced System Settings.

Click "Edit". Select the "VMkernel.Boot.execInstalledOnly" value and configure it to "true".

or

From a PowerCLI command prompt while connected to the ESXi host, run the following command:

Get-VMHost | Get-AdvancedSetting -Name VMkernel.Boot.execInstalledOnly | Set-AdvancedSetting -Value True

Check Contents

If the ESXi host does not have a compatible TPM, this finding is downgraded to a CAT III.

From the vSphere Client, go to Hosts and Clusters.

Select the ESXi Host >> Configure >> System >> Advanced System Settings.

Select the "VMkernel.Boot.execInstalledOnly" value and verify that it is "true".

or

From a PowerCLI command prompt while connected to the ESXi host, run the following command:

Get-VMHost | Get-AdvancedSetting -Name VMkernel.Boot.execInstalledOnly

If the "VMkernel.Boot.execInstalledOnly" setting is not "true", this is a finding.

Vulnerability Number

V-258798

Documentable

False

Rule Version

ESXI-80-000244

Severity Override Guidance

If the ESXi host does not have a compatible TPM, this finding is downgraded to a CAT III.

From the vSphere Client, go to Hosts and Clusters.

Select the ESXi Host >> Configure >> System >> Advanced System Settings.

Select the "VMkernel.Boot.execInstalledOnly" value and verify that it is "true".

or

From a PowerCLI command prompt while connected to the ESXi host, run the following command:

Get-VMHost | Get-AdvancedSetting -Name VMkernel.Boot.execInstalledOnly

If the "VMkernel.Boot.execInstalledOnly" setting is not "true", this is a finding.

Check Content Reference

M

Target Key

5562