What’s Vulnerable › Vulnerabilities

CVE-2025-22225: VMware ESXi Arbitrary Write Vulnerability

• Severity: high (CVSS 8.2 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2025-03-04
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-03-04 · updated 2026-08-04
• Weakness: CWE-787

Description

VMware ESXi contains an arbitrary write vulnerability. A malicious actor with privileges within the VMX process may trigger an arbitrary kernel write leading to an escape of the sandbox.

Summary

VMware ESXi contains an arbitrary write vulnerability in which an actor with privileges in the VMX process can trigger an arbitrary kernel write, escaping the sandbox. Rated CVSS 8.2 (high), it affects VMware ESXi, VMware Cloud Foundation, VMware Telco Cloud Infrastructure, and VMware Telco Cloud Platform. CISA lists it as known exploited with active exploitation. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use if mitigations are unavailable.

تحتوي VMware ESXi على ثغرة كتابة عشوائية تتيح لجهة فاعلة تمتلك صلاحيات داخل عملية VMX تحفيز كتابة عشوائية في النواة، ما يؤدي إلى الهروب من بيئة العزل. الثغرة مصنفة بدرجة 8.2 (عالية) وتؤثر في VMware ESXi وVMware Cloud Foundation وVMware Telco Cloud Infrastructure وVMware Telco Cloud Platform. أدرجتها CISA ضمن الثغرات المعروفة بالاستغلال مع استغلال نشط. طبّق التخفيفات وفق تعليمات المورّد، واتبع إرشادات BOD 22-01 ذات الصلة للخدمات السحابية، أو أوقف استخدام المنتج إذا لم تتوفر التخفيفات.

Affected products

• VMware Cloud Foundation: all versions
• VMware ESXi: 7.0-beta, 7.0-update_1, 7.0-update_1a, 7.0-update_1b, 7.0-update_1c, 7.0-update_1d (+35); 7.0, 8.0
• VMware Telco Cloud Infrastructure: 2.2, 2.5, 2.7, 3.0 (and their updates)
• VMware Telco Cloud Platform: 2.0, 2.5, 2.7, 3.0, 4.0, 4.0.1 (+1) (and their updates)
• VMware Cloud Foundation: 5.x, 4.5.x
• VMware ESXi: from 8.0 before ESXi80U3d-24585383; from 8.0 before ESXi80U2d-24585300; from 7.0 before ESXi70U3s-24585291 — fixed in ESXi80U3d-24585383, ESXi80U2d-24585300, ESXi70U3s-24585291
• VMware Telco Cloud Infrastructure: 3.x, 2.x
• VMware Telco Cloud Platform: 5.x, 4.x, 3.x, 2.x

How to fix

Upgrade to a fixed version: VMware ESXi ESXi80U3d-24585383, ESXi80U2d-24585300, ESXi70U3s-24585291. Check the vendor advisory for mitigations.

References

• https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25390
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-22225

Get alerted when CVE-2025-22225 or the next vulnerability affects your stack