STIGQter: STIG Summary: VMware vSphere 8.0 ESXi Security Technical Implementation Guide Version: 2 Release: 4 Benchmark Date: 01 Jul 2026:

The ESXi host must disable key persistence.

DISA Rule

SV-265975r1003581_rule

Vulnerability Number

V-265975

Group Title

SRG-OS-000480-VMM-002000

Rule Version

ESXI-80-000248

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

From an ESXi shell, run the following command:

# esxcli system security keypersistence disable --remove-all-stored-keys

or

From a PowerCLI command prompt while connected to the ESXi host, run the following commands:

$esxcli = Get-EsxCli -v2
$arguments = $esxcli.system.security.keypersistence.disable.CreateArgs()
$arguments.removeallstoredkeys = $true
$esxcli.system.security.keypersistence.disable.invoke($arguments)

Check Contents

If the ESXi host does not have a compatible TPM, this is not applicable.

From an ESXi shell, run the following command:

# esxcli system security keypersistence get

or

From a PowerCLI command prompt while connected to the ESXi host, run the following commands:

$esxcli = Get-EsxCli -v2
$esxcli.system.security.keypersistence.get.invoke()

If key persistence is enabled, this is a finding.

Vulnerability Number

V-265975

Documentable

False

Rule Version

ESXI-80-000248

Severity Override Guidance

If the ESXi host does not have a compatible TPM, this is not applicable.

From an ESXi shell, run the following command:

# esxcli system security keypersistence get

or

From a PowerCLI command prompt while connected to the ESXi host, run the following commands:

$esxcli = Get-EsxCli -v2
$esxcli.system.security.keypersistence.get.invoke()

If key persistence is enabled, this is a finding.

Check Content Reference

M

Target Key

5562