Sandbox Escape via Arbitrary Kernel Write in VMware ESXi (Actively Exploited)
CISA: VMware ESXi Arbitrary Write Vulnerability
CVSS 3.1
8.2high
EPSS
<1%p61
Published
()
KEV added
AI analysis
VMware ESXi contains an arbitrary write vulnerability (CWE-787/CWE-123) in which an actor with privileges inside the VMX process can trigger a write into the kernel, escaping the ESXi sandbox. The flaw is exploited locally (AV:L), requires high privileges within the VMX process (PR:H), and involves no user interaction, so it is typically reached by chaining another ESXi/VMX bug or after an attacker already has a foothold on the host. Successful exploitation yields a sandbox escape with high confidentiality, integrity, and availability impact, effectively giving the attacker broad control at the hypervisor level. Any organization running VMware ESXi — including the ESXi components within VMware Cloud Foundation and VMware Telco Cloud Infrastructure/Platform — is potentially affected. The flaw is being exploited in the wild and was added to CISA's KEV on 2025-03-04 with known ransomware use; media reports attribute exploitation to China-linked actors, and Broadcom has released urgent patches.
What to do: Apply the ESXi updates released by Broadcom/VMware for CVE-2025-22225 (covering ESXi components inside VMware Cloud Foundation and Telco Cloud deployments), prioritizing internet-facing hosts, and follow CISA KEV required actions — federal agencies must remediate per BOD 22-01 deadlines. Since exploitation is confirmed in the wild with known ransomware use, check ESXi hosts for signs of compromise and restrict/remove management interfaces from the internet until patched. No public PoC is known, so rely on vendor guidance for mitigations if immediate patching is not possible.
Affected
vmware ESXi
—
VMware Cloud Foundation
—
VMware Telco Cloud Infrastructure
—
VMware Telco Cloud Platform
—
Estimated exposure
mass≈100,000–1,000,000 ESXi hosts deployed worldwide, with tens of thousands of ESXi instances directly exposed to the internet — ESXi is one of the most widely deployed enterprise hypervisors, with installed bases in the hundreds of thousands of hosts, and public internet scans routinely show tens of thousands of ESXi management interfaces exposed online; the…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
VMware ESXi contains an arbitrary write vulnerability. A malicious actor with privileges within the VMX process may trigger an arbitrary kernel write leading to an escape of the sandbox.
CISA Known Exploited Vulnerability
Affected
VMware ESXi
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA warns ransomware gangs now exploit critical VMware vCenter syslog RCE CVE-2026-59310, already KEV-listed after APT compromises across 47 countries.
Broadcom patched critical directory traversal flaw CVE-2026-59310 in the vCenter Syslog server on July 29, warning of unauthenticated remote code execution. QUIRSO subsequently found 361 compromised IPs across 47 countries after a suspected APT deployed a reverse SSH tool for persistence and remote access. CISA added the flaw to its KEV catalog with a three-day patch deadline for federal agencies, and over the weekend updated it to flag active abuse by ransomware gangs. Shadowserver tracks over 450 exposed vCenter servers, and CISA has tagged 26 VMware vulnerabilities as exploited in the wild over five years, nine abused by ransomware.