CVE-2025-22225

VMware ESXi is the “host platform” that keeps virtual machines separated from the real server. This bug lets a very privileged attacker inside the VMX process overwrite important memory, which can allow them to break out of the virtual boundary and control the actual ESXi host.

Think of it like someone who already has special access inside a secure “room” being able to rewrite the room’s safety controls so they can take over the whole building.

This matters if you use VMware ESXi, VMware Cloud Foundation, or VMware Telco Cloud Platform/Infrastructure that includes the ESXi host component. It targets attackers who already have high privileges within the VMX process, meaning it’s most relevant in environments where an attacker may already be inside a VM or has gained privileged access.

Per the available findings, treat it as a real-world risk particularly because CISA lists it as KEV and ransomware usage has been reported at the campaign level; the practical reachability is limited to cases where an attacker can get VMX-process privileges on the ESXi host.

This is a RED issue because CISA added CVE-2025-22225 to the KEV catalog (with a remediation due date of 2025-03-25) and it is reported as being used in ransomware campaigns. If ransomware or a similarly capable intruder can reach the VMX-process privilege level on your ESXi hosts, this can enable escape to the underlying server and full host control.

Do not wait for public exploit code—act on patching and vendor mitigations for ESXi hosts now.

Confirm exposure (what to check)

• Identify every ESXi host (and any ESXi components underlying VMware Cloud Foundation / Telco Cloud offerings) and record the exact ESXi version/build.
• Check whether your environment includes pathways where an attacker could gain privileges within the VMX process (for example, via a prior compromise inside virtualized workloads). The findings specify the key precondition: the actor must already have access and privileges within the VMX process.

Determine whether you’re vulnerable

• You’re exposed if your ESXi version is earlier than the fixed releases listed by the vendor.
• Fixed versions per vendor:
  • VMware ESXi → fixed in ESXi80U3d-24585383
  • VMware ESXi → fixed in ESXi80U2d-24585300
  • VMware ESXi → fixed in ESXi70U3s-24585291

Upgrade / patch path

• For each ESXi host, upgrade to the fixed version matching your release branch.
• Validate after upgrade that the host build matches the target fixed build.

If patching is delayed

• Apply the mitigations described in VMware/Broadcom’s Security Advisory for CVE-2025-22225 (CISA KEV requires applying mitigations per vendor instructions when patching is not immediately feasible).
• If mitigations are not available in your setup, CISA’s KEV guidance indicates you should discontinue use of the product.

Timeline / KEV due date

• CISA remediation due date for KEV: 2025-03-25.

What to monitor

• Look for suspicious activity related to the ESXi host and VMX process operations, especially following any signs of compromise in your virtualized workloads.
• Monitor for indicators of ransomware activity and host-level abnormal behavior, since CISA KEV ties this vulnerability to ransomware campaigns.

• Vulnerability type: Arbitrary write enabling kernel write and sandbox escape (CWE-787, CWE-123).
• Mechanism: An attacker with privileges within the VMX process can trigger an arbitrary kernel write, allowing them to escape the virtualization sandbox and gain control of the ESXi host.
• Attack vector & prerequisites: Local scenario with high authentication requirements; no user interaction required. The key prerequisite is attacker privileges within the VMX process.
• Exploitation status: Listed in CISA KEV (added 2025-03-04) and stated as used in ransomware campaigns; treat as exploited in the real world per KEV.
• Patch availability: Fixed builds are provided for multiple ESXi branches (ESXi80U3d-24585383, ESXi80U2d-24585300, ESXi70U3s-24585291).
• Public exploit code: No public exploit code on record (per provided findings), which does not reduce urgency given KEV status.
• EPSS: A low predicted likelihood is noted in the findings, but exploitation confirmation via KEV takes precedence for prioritization.
• KEV meaning here: CISA has identified it as a known exploited vulnerability requiring timely mitigation; the findings also include a remediation due date (2025-03-25) and required actions consistent with applying vendor mitigations or discontinuing use if mitigations are unavailable.