Pierluigi Paganini
March 04, 2025
Broadcom released security updates to address three VMware zero-day vulnerabilities in ESX products that are actively exploited in the wild.
The flaws, respectively tracked as CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226, impact multiple VMware ESX products, including VMware ESXi, vSphere, Workstation, Fusion, Cloud Foundation, and Telco Cloud Platform.
Researchers from Microsoft Threat Intelligence Center discovered the three vulnerabilities.
An attacker with privileged administrator or root access can chain the vulnerabilities to escape the sandbox within the virtual machine.
Below are the descriptions for these vulnerabilities:
The virtualization giant confirmed that it has information to suggest that exploitation of the three flaws has occurred in the wild.
“On March 4, 2025 Broadcom released a critical VMware Security Advisory (VMSA), VMSA-2025-0004, addressing security vulnerabilities found and resolved in VMware ESX regarding a mechanism where threat actors could access the hypervisor through a running virtual machine” states the company. “Are the vulnerabilities being exploited “in the wild?” Broadcom has information to suggest that exploitation of these issues has occurred “in the wild.” “Is this a “VM Escape?” “Yes. This is a situation where an attacker who has already compromised a virtual machine’s guest OS and gained privileged access (administrator or root) could move into the hypervisor itself.”
The company has not disclosed specific details about the attacks or the threat actors behind them.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, ESX)
