TMA-ESXI9-2.2
Host must have all software updates installed
Description
Applying updates in a timely manner according to the severity of issues contributes greatly to the resilience of an environment. When applying updates, it is recommended to update vCenter Server first, if an update is available, and then proceed with updating ESXi. This sequence ensures that the management layer is updated before updating the ESXi hosts. Manual review: the check needs vCenter/PowerCLI, firmware or guest access, or an organization-specific value.
How it is checked
Audit method: Manual review
This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.
Verify that the patches are up to date. The following PowerCLI snippet will provide a list of all installed patches: Foreach ($VMHost in Get-VMHost ) { $EsxCli = Get-EsxCli -VMHost $VMHost -V2 $EsxCli.software.vib.list.invoke() | Select-Object @{N="VMHost";E={$VMHost}},* } You may also manage updates via VMware Lifecycle Manager located under Menu, Lifecycle Manager.
How it is fixed
Fix method: Guidance or infrastructure patch
Use VMware Lifecycle Manager to update and upgrade hosts when ESXi is managed through VMware vCenter. For standalone hosts use esxcli or API-driven methods for applying updates. Employ a process to keep ESXi hosts up to date with patches in accordance with industry standards and internal guidelines. Leverage the VMware Lifecycle Manager to test and apply patches as they become available.
Properties
- Operating systems
- Any
- Tags
- vmwareesxibase
- Reference
- CIS VMware ESXi 9.0 Benchmark v1.0.0 - 2.2 Host must have all software updates installed