Attacks Target VMware ESXi Security Vulnerabilities
Broadcom has released security updates to fix three critical vulnerabilities in VMware ESXi, Workstation, and Fusion products. These vulnerabilities are being actively exploited and could lead to unauthorized code execution or information leakage.
List of Security Vulnerabilities:
| CVE | CVSS Score | Description of Vulnerability | Impact |
| CVE-2025-22224 | 9.3 (Critical) | TOCTOU (Time-of-Check Time-of-Use) vulnerability causes out-of-bounds write. | An attacker with administrative privileges on a virtual machine can execute code with the privileges of the VMX process on the host. |
| CVE-2025-22225 | 8.2 (Important) | Arbitrary write vulnerability, which can lead to sandbox escape exploitation. | An attacker with access to the VMX process can write to the kernel, leading to an escape from the virtualization environment. |
| CVE-2025-22226 | 7.1 (Important) | Out-of-bounds read vulnerability in HGFS. | An attacker with administrative privileges on a virtual machine can leak data from the VMX process. |
Affected Versions:
VMware ESXi 8.0
VMware ESXi 7.0
VMware Workstation 17.x
VMware Fusion 13.x
VMware Cloud Foundation 5.x
VMware Cloud Foundation 4.x
VMware Telco Cloud Platform 5.x, 4.x, 3.x, 2.x
VMware Telco Cloud Infrastructure 3.x, 2.x
Broadcom confirmed that they have "information indicating these vulnerabilities have been exploited in the wild." However, the company did not provide further details about the attack methods or the identities of the threat actors involved.
Patch and Mitigation Measures
| Product | Affected Versions | CVE | Fixed Version |
| VMware ESXi | 8.0 | CVE-2025-22224, CVE-2025-22225, CVE-2025-22226 | ESXi80U3d-24585383, ESXi80U2d-24585300 |
| VMware ESXi | 7.0 | CVE-2025-22224, CVE-2025-22225, CVE-2025-22226 | ESXi70U3s-24585291 |
| VMware Workstation | 17.x | CVE-2025-22224, CVE-2025-22226 | 17.6.3 |
| VMware Fusion | 13.x | CVE-2025-22226 | 13.6.3 |
| VMware Cloud Foundation | 5.x, 4.x | CVE-2025-22224, CVE-2025-22225, CVE-2025-22226 | Async patch ESXi80U3d-24585383 / ESXi70U3s-24585291 |
| VMware Telco Cloud Platform | 5.x, 4.x, 3.x, 2.x | CVE-2025-22224, CVE-2025-22225, CVE-2025-22226 | KB389385 |
These vulnerabilities were discovered and reported by the Microsoft Threat Intelligence Center. Since they are being actively exploited, users are advised to update to the latest patches immediately to ensure system security. 🚨
References
VMware Security Flaws Exploited in the Wild—Broadcom Releases Urgent Patches-https://thehackernews.com/2025/03/vmware-security-flaws-exploited-in.html
VMSA-2025-0004: VMware ESXi, Workstation, and Fusion updates address multiple vulnerabilities (CVE-2025-22224, CVE-2025-22225, CVE-2025-22226)-https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25390
