Chinese-speaking hackers exploited ESXi zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-22224 | TOCTOU Out-of-Bounds Write in VMware ESXi and Workstation Enables Guest-to-Host Escape VMware ESXi and Workstation contain a time-of-check to time-of-use (TOCTOU) race condition (CWE-367) that can lead to an out-of-bounds write in the virtual machine's VMX process. To trigger it, a malicious actor needs local administrative privileges inside a guest virtual machine, where the race condition between the host's check and use of a resource can be exploited. Successful exploitation executes code as the VMX process on the host - effectively a guest-to-host escape, since the VMX process runs with host-level privileges on ESXi - reflected in the CVSS 3.1 score of 8.2 with changed scope. Affected products per the available data are VMware ESXi and Workstation, plus VMware Cloud Foundation and VMware Telco Cloud Infrastructure/Platform, which bundle the affected components; specific affected or fixed version ranges are not stated in the provided data. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-03-04, confirming active in-the-wild exploitation (ransomware use is listed as unknown), though no public proof-of-concept code is known. Do: Upgrade ESXi, Workstation, VMware Cloud Foundation, and Telco Cloud deployments to the patched releases identified in Broadcom's security advisory (fixed version numbers are not present in the provided data, so confirm them directly in the advisory); because the flaw is on CISA KEV, BOD 22-01-bound organizations must apply vendor mitigations or patches by the KEV deadline or discontinue use of the product. As an interim measure, restrict local administrative privileges inside guest VMs to trusted users only, since guest admin access is the prerequisite for exploitation. Prioritize hosts that are internet-reachable or multi-tenant, where untrusted users are more likely to hold guest admin rights. | 8.2 | 2% | KEV |
| masson the order of 100,000+ internet-exposed ESXi hosts, with the total ESXi/Workstation install base plausibly in the hundreds of thousands to millions | |
| CVE-2025-22225 | Sandbox Escape via Arbitrary Kernel Write in VMware ESXi (Actively Exploited) VMware ESXi contains an arbitrary write vulnerability (CWE-787/CWE-123) in which an actor with privileges inside the VMX process can trigger a write into the kernel, escaping the ESXi sandbox. The flaw is exploited locally (AV:L), requires high privileges within the VMX process (PR:H), and involves no user interaction, so it is typically reached by chaining another ESXi/VMX bug or after an attacker already has a foothold on the host. Successful exploitation yields a sandbox escape with high confidentiality, integrity, and availability impact, effectively giving the attacker broad control at the hypervisor level. Any organization running VMware ESXi — including the ESXi components within VMware Cloud Foundation and VMware Telco Cloud Infrastructure/Platform — is potentially affected. The flaw is being exploited in the wild and was added to CISA's KEV on 2025-03-04 with known ransomware use; media reports attribute exploitation to China-linked actors, and Broadcom has released urgent patches. Do: Apply the ESXi updates released by Broadcom/VMware for CVE-2025-22225 (covering ESXi components inside VMware Cloud Foundation and Telco Cloud deployments), prioritizing internet-facing hosts, and follow CISA KEV required actions — federal agencies must remediate per BOD 22-01 deadlines. Since exploitation is confirmed in the wild with known ransomware use, check ESXi hosts for signs of compromise and restrict/remove management interfaces from the internet until patched. No public PoC is known, so rely on vendor guidance for mitigations if immediate patching is not possible. | 8.2 | <1% | KEV ransomware |
| mass≈100,000–1,000,000 ESXi hosts deployed worldwide, with tens of thousands of ESXi instances directly exposed to the internet | |
| CVE-2025-22226 | Out-of-Bounds Read in VMware ESXi, Workstation, and Fusion Leaks Host Memory via HGFS CVE-2025-22226 is an information disclosure vulnerability in the HGFS (Host Guest File System) component of VMware ESXi, Workstation, and Fusion, caused by an out-of-bounds read (CWE-125) in the vmx process. It is triggered when a malicious actor who already holds administrative privileges inside a guest virtual machine interacts with HGFS, causing the vulnerable code to read beyond a buffer boundary. Successful exploitation allows the attacker to leak memory from the host-side vmx process, potentially exposing sensitive host or cross-VM data (confidentiality-only impact; CVSS 6.0 with scope change). Any organization running ESXi standalone or as part of VMware Cloud Foundation or the Telco Cloud products, as well as users of Workstation or Fusion desktop hypervisors, is potentially affected. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2025-03-04, confirming exploitation in the wild; no public PoC is known and ransomware use is listed as unknown (EPSS ~1.7%, 76th percentile). Do: Apply the patched releases published in Broadcom's VMware advisory (released alongside CISA's KEV entry on 2025-03-04) for ESXi, Workstation, Fusion, and any Cloud Foundation/Telco Cloud deployments; federal agencies must remediate per BOD 22-01 timelines. Where shared folders/HGFS are not required, disable them, and restrict administrative privileges inside guest VMs since guest admin access is the prerequisite for exploitation. Verify current build numbers against the advisory, as the source data does not specify fixed versions. | 6.0 | 2% | KEV |
| mass≈100,000+ internet-exposed ESXi/vSphere hosts, plus a very large Workstation and Fusion desktop install base (order of magnitude: mass) |
Full article645 words · extracted from securityaffairs.com · click to collapse
Chinese-speaking attackers used a hacked SonicWall VPN to deploy ESXi zero-days that were likely exploited over a year before public disclosure.
Chinese-speaking attackers were seen abusing a hacked SonicWall VPN to deliver a toolkit targeting VMware ESXi.
The exploit chain included a sophisticated VM escape and appears to have been developed more than a year before the related VMware flaws were publicly disclosed. Analysis of attacks observed in December 2025 suggests the group had early knowledge of three ESXi zero-day vulnerabilities later revealed in March 2025, indicating long-term, covert exploitation of unknown flaws.
In December 2025, Huntress researchers detected an intrusion that led to the deployment of a VMware ESXi exploit toolkit, with initial access attributed to a compromised SonicWall VPN.
Evidence such as simplified Chinese strings and build paths suggests the toolkit was likely developed as a zero-day more than a year before VMware publicly disclosed the flaws, pointing to a well-resourced Chinese-speaking actor.
The attackers laterally moved using Domain Admin credentials, performed reconnaissance, modified firewall rules to block external access while preserving internal movement, and staged data for exfiltration. The toolkit targeted up to 155 ESXi builds and enabled VM escape via disabled VMCI drivers and unsigned kernel drivers, potentially paving the way for ransomware. The attack was ultimately stopped before impact.
VMware’s March 2025 advisory VMSA‑2025‑0004 fixed three zero‑days actively exploited in the wild that enable ESXi VM escape and code execution:
- CVE-2025-22226 (CVSS 7.1): An out-of-bounds read in HGFS that allows leaking memory from the VMX process
- CVE-2025-22224 (CVSS 9.3): A TOCTOU vulnerability in VMCI leading to an out-of-bounds write, allowing code execution as the VMX process
- CVE-2025-22225 (CVSS 8.2): An arbitrary write vulnerability in ESXi that allows escaping the VMX sandbox to the kernel
The threat actors rely on an orchestrator called MAESTRO to manage a full VMware ESXi VM escape. It disables VMCI drivers, loads an unsigned exploit driver via BYOD techniques, and coordinates exploitation. The driver leaks VMX memory to bypass ASLR, abuses HGFS and VMCI flaws, writes shellcode into the VMX process, and escapes to the ESXi kernel. It then deploys a stealthy VSOCK-based backdoor (VSOCKpuppet), enabling persistent remote control of the hypervisor from guest VMs while evading traditional network monitoring and restoring drivers to reduce detection.
Huntress researchers found evidence that the exploit chain may have been used since at least February 2024.
“The exploit binaries contain PDB paths that offer insight into the development environment.” reads the report published by Huntress.
“MyDriver.sys:
- C:\Users\test\Desktop\2024_02_19\全版本逃逸–交付\report\ESXI_8.0u3\
The folder name translates to “All version escape – delivery”, suggesting this was a packaged deliverable targeting ESXi 8.0 Update 3. The date in the path (February 19, 2024) predates VMware’s public disclosure by over a year, confirming this was developed as a potential zero-day exploit.”
The toolkit shows mixed clues about its origin. Development paths include simplified Chinese, but the README is written in English, suggesting it may have been built for wider distribution or sale. Driver files reference “XLab,” a generic name that could be coincidental, with no confirmed link to any organization. Overall, the use of Chinese artifacts, high technical sophistication, and possible access to zero-day exploits well before disclosure point to a well-funded developer likely operating in a Chinese-speaking region.
“This intrusion demonstrates a sophisticated, multi-stage attack chain designed to escape virtual machine isolation and compromise the underlying ESXi hypervisor. By chaining an information leak, memory corruption, and sandbox escape, the threat actor achieved what every VM administrator fears: full control of the hypervisor from within a guest VM.” concludes the report. “The development timeline revealed in the PDB paths tells us that this exploit potentially existed as a zero-day for over a year before VMware’s public disclosure, highlighting the persistent threat posed by well-resourced actors with access to unpatched vulnerabilities.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, zero-day)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/186709/hacking/chinese-speaking-hackers-exploited-esxi-zero-days-long-before-disclosure.html