---
id: "CVE-2025-22225"
kind: "vulnerability"
aliases: ["CVE-2025-22225"]
title: "VMware ESXi contains an arbitrary write vulnerability"
severity: "high"
cvss: 8.2
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "VMware ESXi", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "vmware esxi", "fixed": [], "affected": "= 7.0", "ecosystem": "vendor"}, {"name": "vmware esxi", "fixed": [], "affected": "= 8.0", "ecosystem": "vendor"}, {"name": "vmware cloud foundation", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "vmware telco cloud infrastructure", "fixed": [], "affected": "= 2.2", "ecosystem": "vendor"}, {"name": "vmware telco cloud infrastructure", "fixed": [], "affected": "= 2.5", "ecosystem": "vendor"}, {"name": "vmware telco cloud infrastructure", "fixed": [], "affected": "= 2.7", "ecosystem": "vendor"}, {"name": "vmware telco cloud infrastructure", "fixed": [], "affected": "= 3.0", "ecosystem": "vendor"}, {"name": "vmware telco cloud platform", "fixed": [], "affected": "= 2.0", "ecosystem": "vendor"}, {"name": "vmware telco cloud platform", "fixed": [], "affected": "= 2.5", "ecosystem": "vendor"}, {"name": "vmware telco cloud platform", "fixed": [], "affected": "= 2.7", "ecosystem": "vendor"}, {"name": "vmware telco cloud platform", "fixed": [], "affected": "= 3.0", "ecosystem": "vendor"}, {"name": "vmware telco cloud platform", "fixed": [], "affected": "= 4.0", "ecosystem": "vendor"}, {"name": "vmware telco cloud platform", "fixed": [], "affected": "= 4.0.1", "ecosystem": "vendor"}, {"name": "vmware telco cloud platform", "fixed": [], "affected": "= 5.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["esxi", "exploited", "infrastructure", "ransomware", "self-hosted", "virtualization", "vmware"]
not_affected_if: ["managed-hosting"]
published_at: "2025-03-04T00:00:00+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:05+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-22225", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22225", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# VMware ESXi contains an arbitrary write vulnerability

VMware ESXi has an arbitrary kernel write flaw that lets someone with privileges inside the VMX process escape the VM sandbox. CISA lists it as exploited in the wild, and the sources say it is linked to ransomware use.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:VMware ESXi affected ? fixed ?
- vendor:vmware esxi affected = 7.0 fixed ?
- vendor:vmware esxi affected = 8.0 fixed ?
- vendor:vmware cloud foundation affected ? fixed ?
- vendor:vmware telco cloud infrastructure affected = 2.2 fixed ?
- vendor:vmware telco cloud infrastructure affected = 2.5 fixed ?
- vendor:vmware telco cloud infrastructure affected = 2.7 fixed ?
- vendor:vmware telco cloud infrastructure affected = 3.0 fixed ?
- vendor:vmware telco cloud platform affected = 2.0 fixed ?
- vendor:vmware telco cloud platform affected = 2.5 fixed ?
- vendor:vmware telco cloud platform affected = 2.7 fixed ?
- vendor:vmware telco cloud platform affected = 3.0 fixed ?
- vendor:vmware telco cloud platform affected = 4.0 fixed ?
- vendor:vmware telco cloud platform affected = 4.0.1 fixed ?
- vendor:vmware telco cloud platform affected = 5.0 fixed ?

## How to check

Check the ESXi build against the VMware advisory for CVE-2025-22225 (VMSA-2025-0004); the sources do not give exact fixed build numbers.

## Fix

Apply the vendor patch or mitigations per VMware instructions; CISA says to discontinue use if mitigations are unavailable.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-22225
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-22225

## From the sources

VMware ESXi contains an arbitrary write vulnerability. Successful exploitation allows an attacker with privileges within the VMX process to trigger an arbitrary kernel write leading to an escape of the sandbox.

CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_