{"id":"CVE-2025-22225","kind":"vulnerability","aliases":["CVE-2025-22225"],"related":[],"title":"VMware ESXi contains an arbitrary write vulnerability","description":"VMware ESXi contains an arbitrary write vulnerability. Successful exploitation allows an attacker with privileges within the VMX process to trigger an arbitrary kernel write leading to an escape of the sandbox.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"VMware ESXi has an arbitrary kernel write flaw that lets someone with privileges inside the VMX process escape the VM sandbox. CISA lists it as exploited in the wild, and the sources say it is linked to ransomware use.","severity":"high","cvss":8.2,"epss":null,"exploited":true,"exploited_at":"2025-03-04T00:00:00+00:00","products":[{"name":"VMware ESXi","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"vmware esxi","fixed":[],"affected":"= 7.0","ecosystem":"vendor"},{"name":"vmware esxi","fixed":[],"affected":"= 8.0","ecosystem":"vendor"},{"name":"vmware cloud foundation","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"vmware telco cloud infrastructure","fixed":[],"affected":"= 2.2","ecosystem":"vendor"},{"name":"vmware telco cloud infrastructure","fixed":[],"affected":"= 2.5","ecosystem":"vendor"},{"name":"vmware telco cloud infrastructure","fixed":[],"affected":"= 2.7","ecosystem":"vendor"},{"name":"vmware telco cloud infrastructure","fixed":[],"affected":"= 3.0","ecosystem":"vendor"},{"name":"vmware telco cloud platform","fixed":[],"affected":"= 2.0","ecosystem":"vendor"},{"name":"vmware telco cloud platform","fixed":[],"affected":"= 2.5","ecosystem":"vendor"},{"name":"vmware telco cloud platform","fixed":[],"affected":"= 2.7","ecosystem":"vendor"},{"name":"vmware telco cloud platform","fixed":[],"affected":"= 3.0","ecosystem":"vendor"},{"name":"vmware telco cloud platform","fixed":[],"affected":"= 4.0","ecosystem":"vendor"},{"name":"vmware telco cloud platform","fixed":[],"affected":"= 4.0.1","ecosystem":"vendor"},{"name":"vmware telco cloud platform","fixed":[],"affected":"= 5.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["esxi","exploited","infrastructure","ransomware","self-hosted","virtualization","vmware"],"not_affected_if":["managed-hosting"],"how_to_check":"Check the ESXi build against the VMware advisory for CVE-2025-22225 (VMSA-2025-0004); the sources do not give exact fixed build numbers.","fix":"Apply the vendor patch or mitigations per VMware instructions; CISA says to discontinue use if mitigations are unavailable.","status":"open","published_at":"2025-03-04T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:52:14+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T20:52:14Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor patch or mitigations per VMware instructions; CISA says to discontinue use if mitigations are unavailable.\nunknown","reach":"local","impact":"high","summary":"VMware ESXi has an arbitrary kernel write flaw that lets someone with privileges inside the VMX process escape the VM sandbox. CISA lists it as exploited in the wild, and the sources say it is linked to ransomware use.","category":"infrastructure","who_cares":["esxi","vmware","self-hosted","virtualization"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker escapes VM sandbox and gains kernel write on the host.","analyst_note":"Find the fixed ESXi builds and mitigation steps in the VMware advisory VMSA-2025-0004 and confirm the affected versions.","how_to_check":"Check the ESXi build against the VMware advisory for CVE-2025-22225 (VMSA-2025-0004); the sources do not give exact fixed build numbers.\nunknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000478,"input_tokens":2666,"output_tokens":423,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':158C '-2025':9A,12A '-22225':10A,13A '22':157C 'action':148C 'allow':124C 'appli':149C 'applic':155C 'arbitrari':5A,80B,119C,136C 'attack':126C 'bod':156C 'cisa':97B,146C 'cloud':21A,25A,29A,33A,37A,41A,45A,49A,53A,57A,61A,65A,161C 'contain':3A,117C 'cve':8A,11A 'discontinu':164C 'escap':93B,142C 'esxi':2A,15A,17A,19A,67B,77B,116C 'exploit':68B,101B,123C 'flaw':83B 'follow':154C 'foundation':22A 'guidanc':159C 'host':73B 'infrastructur':69B 'infrastructure':26A,30A,34A,38A 'insid':89B 'instruct':153C 'kernel':81B,137C 'lead':139C 'let':85B 'link':111B 'list':98B 'mitig':150C,170C 'per':151C 'platform':42A,46A,50A,54A,58A,62A,66A 'privileg':88B,128C 'process':92B,132C 'product':168C 'ransomwar':70B,113B 'requir':147C 'sandbox':96B,145C 'say':108B 'self':72B 'self-host':71B 'servic':162C 'someon':86B 'sourc':107B 'success':122C 'telco':24A,28A,32A,36A,40A,44A,48A,52A,56A,60A,64A 'trigger':134C 'unavail':172C 'use':114B,165C 'vendor':152C 'virtual':74B 'vm':95B 'vmware':1A,14A,16A,18A,20A,23A,27A,31A,35A,39A,43A,47A,51A,55A,59A,63A,75B,76B,115C 'vmx':91B,131C 'vulner':7A,121C 'wild':104B 'within':129C 'write':6A,82B,120C,138C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-03-04T00:00:00+00:00","kev":{"dateAdded":"2025-03-04","dueDate":"2025-03-25","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cvss_by":"security@vmware.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2025-22225","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-22225","severity":null,"published_at":"2025-03-04T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T11:39:14+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-22225","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22225","severity":null,"published_at":"2025-03-04T12:15:33+00:00","modified_at":"2026-08-04T05:16:33+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}