Detections
Analytics

CVE-2025-22225

high

Description

VMware ESXi contains an arbitrary write vulnerability. A malicious actor with privileges within the VMX process may trigger an arbitrary kernel write leading to an escape of the sandbox.

References

https://www.bleepingcomputer.com/news/security/cisa-critical-vmware-vcenter-rce-flaw-now-exploited-by-ransomware-gangs/

https://www.helpnetsecurity.com/2026/02/05/cisa-cve-2025-22225-ransomware-exploitation/

https://www.bleepingcomputer.com/news/security/cisa-vmware-esxi-flaw-now-exploited-in-ransomware-attacks/

https://securityaffairs.com/187637/security/cve-2025-22225-in-vmware-esxi-now-used-in-active-ransomware-attacks.html

https://www.bleepingcomputer.com/news/security/cisa-says-critical-vmware-rce-flaw-now-actively-exploited/

https://www.theregister.com/2026/01/09/china_esxi_zerodays/

https://www.securityweek.com/exploit-for-vmware-zero-day-flaws-likely-built-a-year-before-public-disclosure/

https://thehackernews.com/2026/01/chinese-linked-hackers-exploit-vmware.html

https://securityaffairs.com/186709/hacking/chinese-speaking-hackers-exploited-esxi-zero-days-long-before-disclosure.html

https://hackread.com/maestro-toolkit-vmware-vm-escape-vulnerabilities/

https://www.bleepingcomputer.com/news/security/vmware-esxi-zero-days-likely-exploited-a-year-before-disclosure/

https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-vmware-tools-flaw-exploited-since-october-2024/

https://www.bleepingcomputer.com/news/security/chinese-hackers-exploiting-vmware-zero-day-since-october-2024/

https://www.bleepingcomputer.com/news/security/broadcom-fixes-high-severity-vmware-nsx-bugs-reported-by-nsa/

https://securityaffairs.com/175858/security/authentication-bypass-cve-2025-22230-in-vmware-tools-for-windows.html

https://www.bleepingcomputer.com/news/security/broadcom-warns-of-authentication-bypass-in-vmware-windows-tools/

https://www.securityweek.com/exploited-vmware-esxi-flaws-put-many-at-risk-of-ransomware-other-attacks/

https://www.bleepingcomputer.com/news/security/over-37-000-vmware-esxi-servers-vulnerable-to-ongoing-attacks/

https://www.databreachtoday.com/broadcom-patches-actively-exploited-zero-days-in-vmware-esxi-a-27647

https://www.theregister.com/2025/03/04/vmware_plugs_three_hypervisorhijack_holes/

https://www.securityweek.com/broadcom-patches-3-vmware-zero-days-exploited-in-the-wild/

https://www.infosecurity-magazine.com/news/vmware-patch-exploited-zero-day/

https://www.darkreading.com/vulnerabilities-threats/vmware-zero-day-bugs-sandbox-escape

https://www.cisa.gov/news-events/alerts/2025/03/04/cisa-adds-four-known-exploited-vulnerabilities-catalog

https://www.bleepingcomputer.com/news/security/broadcom-fixes-three-vmware-zero-days-exploited-in-attacks/

https://therecord.media/vmware-exploited-vulnerabilities-esxi-workstation-fusion

https://thehackernews.com/2025/03/vmware-security-flaws-exploited-in.html

https://arstechnica.com/security/2025/03/vmware-patches-3-critical-vulnerabilities-in-multiple-product-lines/

https://www.cisa.gov/news-events/ics-advisories/icsa-25-077-02

https://cloud.google.com/support/bulletins/index#gcp-2025-011

https://www.tenable.com/blog/cve-2025-22224-cve-2025-22225-cve-2025-22226-zero-day-vulnerabilities-in-vmware-esxi

https://github.com/cyberupdates365/ai-cyber-threats-and-cve-mitigation-tracker-2026

https://github.com/bronsoneaver/vme-escape

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-22225

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25390

Details

Source: Mitre, NVD

Published: 2025-03-04

Updated: 2026-08-04

Named Vulnerability: ESXicapeKnown Exploited Vulnerability (KEV)

Risk Information

CVSS v2

Base Score: 6.5

Vector: CVSS2#AV:L/AC:L/Au:M/C:C/I:C/A:C

Severity: Medium

CVSS v3

Base Score: 8.2

Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Severity: High

EPSS

EPSS: 0.01016

Vulnerability Watch

Tenable Research has classified this CVE under the following Vulnerability Watch classification, which includes active and historical (inactive) classifications. You can learn more about these classifications on our blog.

Vulnerability of Interest