VMware ESXi Arbitrary Write Vulnerability (CVE-2025-22225)

What is affected, what to do

VMware ESXi contains an arbitrary write vulnerability. A malicious actor with privileges within the VMX process may trigger an arbitrary kernel write leading to an escape of the sandbox.

The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• VMware ESXi gte 8.0..*
• VMware ESXi gte 7.0..*
• VMware Cloud Foundation eq 5.x, 4.5.x..5.x, 4.5.x
• VMware Telco Cloud Platform eq 5.x, 4.x, 3.x, 2.x..5.x, 4.x, 3.x, 2.x
• VMware Telco Cloud Infrastructure eq 3.x, 2.x..3.x, 2.x

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Apply the vendor patch: Fixed ESXi builds are published in the Broadcom advisory, alongside the related CVE-2025-22224 and CVE-2025-22226. Look up the exact build numbers in the vendor advisory. Start by inventorying versions with esxcli system version get or a vCenter-wide query. Cloud Foundation and Telco Cloud Platform have separate async patches.
   • Order patching by guest trust level: Hosts running untrusted or exposed guests go first: DMZ VMs, VDI, multi-tenant workloads and dev/test VMs with broad admin access. The attacker needs privileges inside the VMX process, typically gained from a compromised guest with local admin rights.
   • Triage for compromise before patching: Preserve evidence before hosts reboot. Collect /var/log/vmkernel.log, vmkwarning.log, hostd.log, shell.log, auth.log, core dumps under /var/core and per-VM vmware.log. Patching and rebooting will not remove persistence an attacker has already planted.
   • Restrict administrative access: Disable SSH and ESXi Shell on every host unless operationally required. Rotate root and vCenter SSO credentials on any host showing anomalies. Check whether AD groups such as "ESX Admins" automatically receive full host privileges.
   • Secure backups: Treat the ransomware flag seriously. Confirm that datastore backups are offline or immutable and authenticate separately from vSphere SSO. Isolate the backup server from the host management network.
2. 02

   Runbook step 2

   Mitigation layers

   • Hypervisor configuration: The vendor lists no equivalent workaround, so patching is the only complete fix. In the meantime, enable Lockdown Mode (Normal or Strict) and set VMkernel.Boot.execInstalledOnly=TRUE to block unsigned, dropped binaries. Monitor Secure Boot and TPM attestation status in vCenter.
   • Guest attack-surface reduction: Remove unneeded virtual hardware such as VMCI devices, shared folders (HGFS), USB and serial controllers. This shrinks the entry path the exploit chain uses to get from the guest into the VMX process. Cut local admin rights inside guests to least privilege.
   • Network segmentation: Expose ESXi management services (443/tcp, 902/tcp, 22/tcp, 5989/tcp CIM-SLP) only to a dedicated admin VLAN or jump hosts. Deny all outbound internet traffic from VMkernel management IPs, since a hypervisor has no business talking to C2 infrastructure.
   • IAM: Separate vCenter and ESXi roles and minimise accounts holding the Administrator role. Enforce MFA for vCenter login through the identity provider. Review AD integration of hosts so that a domain compromise does not automatically become a hypervisor compromise.
   • Workload placement: Until patched, do not co-locate guests of different trust levels on the same host. Use DRS rules to move exposed VMs onto separate clusters.
3. 03

   Runbook step 3

   Detection rules

   • VMX crashes and kernel anomalies: Unexpected VMX crashes, new files under /var/core/ and kernel warnings in vmkwarning.log outside maintenance windows suggest exploitation attempts. Example SPL: index=esxi (source="*vmkwarning.log" OR source="*vmware.log") ("VMX" AND ("panic" OR "Unexpected signal" OR "core dump")).

   • Persistence and tampering: Alert on these changes:

     • VIB acceptance level lowered to CommunitySupported
     • newly installed VIBs
     • execInstalledOnly disabled
     • edits to /etc/rc.local.d/local.sh or /etc/init.d/

     Automate a baseline diff using esxcli software vib list and esxcli software acceptance get.

   • Administrative activity: In hostd.log and vCenter events, watch for "SSH access has been enabled" and "ESXi Shell enabled". In shell.log, look for vim-cmd vmsvc/power.off, esxcli vm process kill, esxcli system settings and execution from /tmp. A Sigma rule can correlate esxcli vm process kill with power.off within 10 minutes.

   • Ransomware indicators on datastores: Strong warning signs include mass renaming of .vmdk/.vmx files, ransom notes appearing in /vmfs/volumes/* and many VMs powering off at once. Define vCenter alarms with a threshold, for example more than 5 "VM powered off" events per host within 5 minutes.

   • Network telemetry: In Zeek/Suricata, flag outbound connections from ESXi management IPs to non-infrastructure destinations, e.g. KQL: CommonSecurityLog | where SourceIP in (esxi_mgmt_ips) and not(DestinationIP in (allowed_infra)). Also watch for unexpected listening sockets visible via esxcli network ip connection list.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

VMware ESXi contains an arbitrary write vulnerability. A malicious actor with privileges within the VMX process may trigger an arbitrary kernel write leading to an escape of the sandbox.

Source: pwn.watch, cvelistv5, CISA KEV Catalog, NVD (NIST), CVE.org (MITRE), CSA/SingCERT

Vendors and products

• VMware VMware Cloud Foundation
• VMware VMware ESXi
• VMware Telco Cloud Infrastructure
• VMware Telco Cloud Platform

Weakness classes (CWE)

• CWE-123Write-what-where Condition

  Base

  Any condition where the attacker has the ability to write an arbitrary value to an arbitrary location, often as the result of a buffer overflow.

  Entry at MITRE CWE-123

References & sources

• support.broadcom.comVMware advisory: VMware ESXipwn-watch
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2025-22225government-resource
• cert.atCERT.at: Kritische Sicherheitslücken in VMware ESXi, Workstation und Fusion - aktiv ausgenutzt - Updates verfügbarcert-at
• pwn.watchpwn.watch: VMware ESXi: ESXi Arbitrary Write Vulnerabilitypwn-watch
• NVD (NIST)NVD: CVE-2025-22225pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch