CISA confirms exploitation of VMware ESXi flaw by ransomware attackers

VMware ESXi and Workstation contain a time-of-check to time-of-use (TOCTOU) race condition (CWE-367) that can lead to an out-of-bounds write in the virtual machine's VMX process. To trigger it, a malicious actor needs local administrative privileges inside a guest virtual machine, where the race condition between the host's check and use of a resource can be exploited. Successful exploitation executes code as the VMX process on the host - effectively a guest-to-host escape, since the VMX process runs with host-level privileges on ESXi - reflected in the CVSS 3.1 score of 8.2 with changed scope. Affected products per the available data are VMware ESXi and Workstation, plus VMware Cloud Foundation and VMware Telco Cloud Infrastructure/Platform, which bundle the affected components; specific affected or fixed version ranges are not stated in the provided data. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-03-04, confirming active in-the-wild exploitation (ransomware use is listed as unknown), though no public proof-of-concept code is known.

Do: Upgrade ESXi, Workstation, VMware Cloud Foundation, and Telco Cloud deployments to the patched releases identified in Broadcom's security advisory (fixed version numbers are not present in the provided data, so confirm them directly in the advisory); because the flaw is on CISA KEV, BOD 22-01-bound organizations must apply vendor mitigations or patches by the KEV deadline or discontinue use of the product. As an interim measure, restrict local administrative privileges inside guest VMs to trusted users only, since guest admin access is the prerequisite for exploitation. Prioritize hosts that are internet-reachable or multi-tenant, where untrusted users are more likely to hold guest admin rights.

VMware ESXi contains an arbitrary write vulnerability (CWE-787/CWE-123) in which an actor with privileges inside the VMX process can trigger a write into the kernel, escaping the ESXi sandbox. The flaw is exploited locally (AV:L), requires high privileges within the VMX process (PR:H), and involves no user interaction, so it is typically reached by chaining another ESXi/VMX bug or after an attacker already has a foothold on the host. Successful exploitation yields a sandbox escape with high confidentiality, integrity, and availability impact, effectively giving the attacker broad control at the hypervisor level. Any organization running VMware ESXi — including the ESXi components within VMware Cloud Foundation and VMware Telco Cloud Infrastructure/Platform — is potentially affected. The flaw is being exploited in the wild and was added to CISA's KEV on 2025-03-04 with known ransomware use; media reports attribute exploitation to China-linked actors, and Broadcom has released urgent patches.

Do: Apply the ESXi updates released by Broadcom/VMware for CVE-2025-22225 (covering ESXi components inside VMware Cloud Foundation and Telco Cloud deployments), prioritizing internet-facing hosts, and follow CISA KEV required actions — federal agencies must remediate per BOD 22-01 deadlines. Since exploitation is confirmed in the wild with known ransomware use, check ESXi hosts for signs of compromise and restrict/remove management interfaces from the internet until patched. No public PoC is known, so rely on vendor guidance for mitigations if immediate patching is not possible.

CVE-2025-22226 is an information disclosure vulnerability in the HGFS (Host Guest File System) component of VMware ESXi, Workstation, and Fusion, caused by an out-of-bounds read (CWE-125) in the vmx process. It is triggered when a malicious actor who already holds administrative privileges inside a guest virtual machine interacts with HGFS, causing the vulnerable code to read beyond a buffer boundary. Successful exploitation allows the attacker to leak memory from the host-side vmx process, potentially exposing sensitive host or cross-VM data (confidentiality-only impact; CVSS 6.0 with scope change). Any organization running ESXi standalone or as part of VMware Cloud Foundation or the Telco Cloud products, as well as users of Workstation or Fusion desktop hypervisors, is potentially affected. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2025-03-04, confirming exploitation in the wild; no public PoC is known and ransomware use is listed as unknown (EPSS ~1.7%, 76th percentile).

Do: Apply the patched releases published in Broadcom's VMware advisory (released alongside CISA's KEV entry on 2025-03-04) for ESXi, Workstation, Fusion, and any Cloud Foundation/Telco Cloud deployments; federal agencies must remediate per BOD 22-01 timelines. Where shared folders/HGFS are not required, disable them, and restrict administrative privileges inside guest VMs since guest admin access is the prerequisite for exploitation. Verify current build numbers against the advisory, as the source data does not specify fixed versions.