STIGQter STIGQter: STIG Summary: VMware vSphere 8.0 vCenter Security Technical Implementation Guide Version: 2 Release: 4 Benchmark Date: 01 Jul 2026:

The vCenter Server must limit membership to the "SystemConfiguration.BashShellAdministrators" Single Sign-On (SSO) group.

DISA Rule

SV-258956r961863_rule

Vulnerability Number

V-258956

Group Title

SRG-APP-000516

Rule Version

VCSA-80-000290

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

From the vSphere Client, go to Administration >> Single Sign On >> Users and Groups >> Groups.

Click the next page arrow until the "SystemConfiguration.BashShellAdministrators" group appears.

Click "SystemConfiguration.BashShellAdministrators".

Click the three vertical dots next to the name of each unauthorized account.

Select "Remove Member".

Check Contents

From the vSphere Client, go to Administration >> Single Sign On >> Users and Groups >> Groups.

Click the next page arrow until the "SystemConfiguration.BashShellAdministrators" group appears.

Click "SystemConfiguration.BashShellAdministrators".

Review the members of the group and ensure that only authorized accounts are present.

Note: By default the Administrator and a unique service account similar to "vmware-applmgmtservice-714684a4-342f-4eff-a232-cdc21def00c2" will be in the group and should not be removed.

If there are any accounts present as members of SystemConfiguration.BashShellAdministrators that are not authorized, this is a finding.

Vulnerability Number

V-258956

Documentable

False

Rule Version

VCSA-80-000290

Severity Override Guidance

From the vSphere Client, go to Administration >> Single Sign On >> Users and Groups >> Groups.

Click the next page arrow until the "SystemConfiguration.BashShellAdministrators" group appears.

Click "SystemConfiguration.BashShellAdministrators".

Review the members of the group and ensure that only authorized accounts are present.

Note: By default the Administrator and a unique service account similar to "vmware-applmgmtservice-714684a4-342f-4eff-a232-cdc21def00c2" will be in the group and should not be removed.

If there are any accounts present as members of SystemConfiguration.BashShellAdministrators that are not authorized, this is a finding.

Check Content Reference

M

Target Key

5573