STIGQter: STIG Summary: VMware vSphere 8.0 ESXi Security Technical Implementation Guide Version: 2 Release: 4 Benchmark Date: 01 Jul 2026:

The ESXi host must deny shell access for the dcui account.

DISA Rule

SV-265976r1003584_rule

Vulnerability Number

V-265976

Group Title

SRG-OS-000480-VMM-002000

Rule Version

ESXI-80-000249

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

From an ESXi shell, run the following command:

# esxcli system account set -i dcui -s false

or

From a PowerCLI command prompt while connected to the ESXi host, run the following commands:

$esxcli = Get-EsxCli -v2
$arguments = $esxcli.system.account.set.CreateArgs()
$arguments.id = "dcui"
$arguments.shellaccess = "false"
$esxcli.system.account.set.invoke($arguments)

Check Contents

From an ESXi shell, run the following command:

# esxcli system account list

or

From a PowerCLI command prompt while connected to the ESXi host, run the following commands:

$esxcli = Get-EsxCli -v2
$esxcli.system.account.list.Invoke() | Where-Object {$_.UserID -eq 'dcui'}

If shell access is not disabled for the dcui account, this is a finding.

Vulnerability Number

V-265976

Documentable

False

Rule Version

ESXI-80-000249

Severity Override Guidance

From an ESXi shell, run the following command:

# esxcli system account list

or

From a PowerCLI command prompt while connected to the ESXi host, run the following commands:

$esxcli = Get-EsxCli -v2
$esxcli.system.account.list.Invoke() | Where-Object {$_.UserID -eq 'dcui'}

If shell access is not disabled for the dcui account, this is a finding.

Check Content Reference

M

Target Key

5562