China-Linked Hackers Exploit VMware ESXi Zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-22224 | TOCTOU Out-of-Bounds Write in VMware ESXi and Workstation Enables Guest-to-Host Escape VMware ESXi and Workstation contain a time-of-check to time-of-use (TOCTOU) race condition (CWE-367) that can lead to an out-of-bounds write in the virtual machine's VMX process. To trigger it, a malicious actor needs local administrative privileges inside a guest virtual machine, where the race condition between the host's check and use of a resource can be exploited. Successful exploitation executes code as the VMX process on the host - effectively a guest-to-host escape, since the VMX process runs with host-level privileges on ESXi - reflected in the CVSS 3.1 score of 8.2 with changed scope. Affected products per the available data are VMware ESXi and Workstation, plus VMware Cloud Foundation and VMware Telco Cloud Infrastructure/Platform, which bundle the affected components; specific affected or fixed version ranges are not stated in the provided data. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-03-04, confirming active in-the-wild exploitation (ransomware use is listed as unknown), though no public proof-of-concept code is known. Do: Upgrade ESXi, Workstation, VMware Cloud Foundation, and Telco Cloud deployments to the patched releases identified in Broadcom's security advisory (fixed version numbers are not present in the provided data, so confirm them directly in the advisory); because the flaw is on CISA KEV, BOD 22-01-bound organizations must apply vendor mitigations or patches by the KEV deadline or discontinue use of the product. As an interim measure, restrict local administrative privileges inside guest VMs to trusted users only, since guest admin access is the prerequisite for exploitation. Prioritize hosts that are internet-reachable or multi-tenant, where untrusted users are more likely to hold guest admin rights. | 8.2 | 2% | KEV |
| masson the order of 100,000+ internet-exposed ESXi hosts, with the total ESXi/Workstation install base plausibly in the hundreds of thousands to millions | |
| CVE-2025-22225 | Sandbox Escape via Arbitrary Kernel Write in VMware ESXi (Actively Exploited) VMware ESXi contains an arbitrary write vulnerability (CWE-787/CWE-123) in which an actor with privileges inside the VMX process can trigger a write into the kernel, escaping the ESXi sandbox. The flaw is exploited locally (AV:L), requires high privileges within the VMX process (PR:H), and involves no user interaction, so it is typically reached by chaining another ESXi/VMX bug or after an attacker already has a foothold on the host. Successful exploitation yields a sandbox escape with high confidentiality, integrity, and availability impact, effectively giving the attacker broad control at the hypervisor level. Any organization running VMware ESXi — including the ESXi components within VMware Cloud Foundation and VMware Telco Cloud Infrastructure/Platform — is potentially affected. The flaw is being exploited in the wild and was added to CISA's KEV on 2025-03-04 with known ransomware use; media reports attribute exploitation to China-linked actors, and Broadcom has released urgent patches. Do: Apply the ESXi updates released by Broadcom/VMware for CVE-2025-22225 (covering ESXi components inside VMware Cloud Foundation and Telco Cloud deployments), prioritizing internet-facing hosts, and follow CISA KEV required actions — federal agencies must remediate per BOD 22-01 deadlines. Since exploitation is confirmed in the wild with known ransomware use, check ESXi hosts for signs of compromise and restrict/remove management interfaces from the internet until patched. No public PoC is known, so rely on vendor guidance for mitigations if immediate patching is not possible. | 8.2 | <1% | KEV ransomware |
| mass≈100,000–1,000,000 ESXi hosts deployed worldwide, with tens of thousands of ESXi instances directly exposed to the internet | |
| CVE-2025-22226 | Out-of-Bounds Read in VMware ESXi, Workstation, and Fusion Leaks Host Memory via HGFS CVE-2025-22226 is an information disclosure vulnerability in the HGFS (Host Guest File System) component of VMware ESXi, Workstation, and Fusion, caused by an out-of-bounds read (CWE-125) in the vmx process. It is triggered when a malicious actor who already holds administrative privileges inside a guest virtual machine interacts with HGFS, causing the vulnerable code to read beyond a buffer boundary. Successful exploitation allows the attacker to leak memory from the host-side vmx process, potentially exposing sensitive host or cross-VM data (confidentiality-only impact; CVSS 6.0 with scope change). Any organization running ESXi standalone or as part of VMware Cloud Foundation or the Telco Cloud products, as well as users of Workstation or Fusion desktop hypervisors, is potentially affected. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2025-03-04, confirming exploitation in the wild; no public PoC is known and ransomware use is listed as unknown (EPSS ~1.7%, 76th percentile). Do: Apply the patched releases published in Broadcom's VMware advisory (released alongside CISA's KEV entry on 2025-03-04) for ESXi, Workstation, Fusion, and any Cloud Foundation/Telco Cloud deployments; federal agencies must remediate per BOD 22-01 timelines. Where shared folders/HGFS are not required, disable them, and restrict administrative privileges inside guest VMs since guest admin access is the prerequisite for exploitation. Verify current build numbers against the advisory, as the source data does not specify fixed versions. | 6.0 | 2% | KEV |
| mass≈100,000+ internet-exposed ESXi/vSphere hosts, plus a very large Workstation and Fusion desktop install base (order of magnitude: mass) |
Full article933 words · extracted from thehackernews.com · click to collapse
Chinese-speaking threat actors are suspected to have leveraged a compromised SonicWall VPN appliance as an initial access vector to deploy a VMware ESXi exploit that may have been developed as far back as February 2024.
Cybersecurity firm Huntress, which observed the activity in December 2025 and stopped it before it could progress to the final stage, said it may have resulted in a ransomware attack.
Most notably, the attack is believed to have exploited three VMware vulnerabilities that were disclosed as zero-days by Broadcom in March 2025: CVE-2025-22224 (CVSS score: 9.3), CVE-2025-22225 (CVSS score: 8.2), and CVE-2025-22226 (CVSS score: 7.1). Successful exploitation of the issue could permit a malicious actor with admin privileges to leak memory from the Virtual Machine Executable (VMX) process or execute code as the VMX process.
That same month, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaws to the Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.
"The toolkit analyzed [...] also includes simplified Chinese strings in its development paths, including a folder named '全版本逃逸--交付' (translated: 'All version escape - delivery'), and evidence suggesting it was potentially built as a zero-day exploit over a year before VMware's public disclosure, pointing to a well-resourced developer likely operating in a Chinese-speaking region," researchers Anna Pham and Matt Anderson said.
The assessment that the toolkit weaponizes the three VMware shortcomings is based on the exploit's behavior, its use of Host-Guest File System (HGFS) for information leaking, Virtual Machine Communication Interface (VMCI) for memory corruption, and shellcode that escapes to the kernel, the company added.
The toolkit involves multiple components, chief among them being "exploit.exe" (aka MAESTRO), which acts as the orchestrator for the entire virtual machine (VM) escape by making use of the following embedded binaries -
- devcon.exe, to disable VMware's guest-side VMCI drivers
- MyDriver.sys, an unsigned kernel driver containing the exploit that's loaded into kernel memory using an open-source tool called Kernel Driver Utility (KDU), following which the exploit status is monitored and the VMCI drivers are re-enabled
 |
| VM Escape exploitation flow |
The driver's main responsibility is to identify the exact ESXi version running on the host and trigger an exploit for CVE-2025-22226 and CVE-2025-22224, ultimately allowing the attacker to write three payloads directly into VMX's memory -
- Stage 1 shellcode, to prepare the environment for the VMX sandbox escape
- Stage 2 shellcode, to establish a foothold on the ESXi host
- VSOCKpuppet, a 64-bit ELF backdoor that provides persistent remote access to the ESXi host and communicates over VSOCK (Virtual Sockets) port 10000
"After writing the payloads, the exploit overwrites a function pointer inside VMX," Huntress explained. "It first saves the original pointer value, then overwrites it with the address of the shellcode. The exploit then sends a VMCI message to the host to trigger VMX."
 |
| VSOCK communication protocol between client.exe and VSOCKpuppet |
"When VMX handles the message, it follows the corrupted pointer and jumps to the attacker's shellcode instead of legitimate code. This final stage corresponds to CVE-2025-22225, which VMware describes as an 'arbitrary write vulnerability' that allows 'escaping the sandbox.'"
Because VSOCK offers a direct communication pathway between guest VMs and the hypervisor, the threat actors have been found to employ a "client.exe" (aka GetShell Plugin) that can be used from any guest Windows VM on the compromised host and send commands back up to the compromised ESXi and interact with the backdoor. The PDB path embedded in the binary reveals it may have been developed in November 2023.
The client supports the ability to download files from ESXi to the VM, upload files from the VM to ESXi, and execute shell commands on the hypervisor. Interestingly, the GetShell Plugin is dropped to the Windows VM in the form of a ZIP archive ("Binary.zip"), which also includes a README file with usage instructions, giving an insight into its file transfer and command execution features.
It's currently not clear who is behind the toolkit, but the use of simplified Chinese, coupled with the sophistication of the attack chain and the abuse of zero-day vulnerabilities months before public disclosure, likely points to a well-resourced developer operating in a Chinese-speaking region, theorized Huntress.
"This intrusion demonstrates a sophisticated, multi-stage attack chain designed to escape virtual machine isolation and compromise the underlying ESXi hypervisor," the company added. "By chaining an information leak, memory corruption, and sandbox escape, the threat actor achieved what every VM administrator fears: full control of the hypervisor from within a guest VM."
"The use of VSOCK for backdoor communication is particularly concerning, as it bypasses traditional network monitoring entirely, making detection significantly harder. The toolkit also prioritizes stealth over persistence."
Pham, a senior tactical response analyst at Huntress, told The Hacker News that there is no evidence to suggest that the toolkit was advertised or sold on dark web forums, adding that it was deployed in a targeted manner.
"However, given the presence of a README file with operational instructions, the toolkit was clearly designed for distribution beyond the original developer," Pham said. "We assess with high confidence that the toolkit is being sold privately by a Chinese-speaking developer, likely through private channels or closed groups rather than public underground markets."
"The targeted nature of observed deployments suggests the toolkit may be distributed selectively to vetted buyers rather than broadly commercialized, consistent with higher-end offensive tooling that operators prefer to keep out of widespread propagation to avoid detection signature development."
(The story was updated after publication to include additional commentary from Huntress.)
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/01/chinese-linked-hackers-exploit-vmware.html