FlagThis

Broadcom has issued urgent security patches to address three actively exploited vulnerabilities affecting VMware ESXi, Workstation, and Fusion products. These flaws, tracked as CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226, could enable attackers to execute code and disclose sensitive information. VMware ESXi is under active exploitation in the wild, making timely patching crucial to prevent potential attacks. The vulnerabilities impact various versions of VMware ESXi 8.0, 7.0, Workstation 17.x, Fusion 13.x, Cloud Foundation 5.x and 4.x, and Telco Cloud Platform.

The most critical flaw, CVE-2025-22224, boasts a CVSS score of 9.3 and is a heap-overflow vulnerability leading to an out-of-bounds write. A malicious actor with local administrative privileges on a virtual machine could exploit this to execute code as the virtual machine's VMX process running on the host. Broadcom credited Microsoft's MSTIC security team with discovering and reporting these vulnerabilities. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added these zero-day vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, requiring federal civilian agencies to patch them by March 25, 2025.

ImgSrc: www.csoonline.c

References :

• bsky.app: Broadcom released security patches to patch an actively exploited zero-day in its VMware ESXi products. Broadcom credited Microsoft's MSTIC security team with spotting and reporting the attacks.
• The Hacker News: Broadcom Releases Urgent Patches
• The Register - Software: VMware splats guest-to-hypervisor escape bugs already exploited in wild
• www.csoonline.com: VMware ESXi gets critical patches for in-the-wild virtual machine escape attack
• securityaffairs.com: VMware fixed three actively exploited zero-days in ESX products
• Arctic Wolf: Three VMware Zero-Days Exploited in the Wild Patched by Broadcom
• bsky.app: BleepingComputer article on VMware zero-days.
• Vulnerability-Lookup: A new bundle, VMSA-2025-0004: VMware ESXi, Workstation, and Fusion updates address multiple vulnerabilities (CVE-2025-22224, CVE-2025-22225, CVE-2025-22226), has been published on Vulnerability-Lookup:
• The Record: Three product lines from technology giant VMware — ESXI, Workstation and Fusion — have patches for vulnerabilities that the company and the federal government have said are being exploited by hackers
• securityaffairs.com: U.S. CISA adds Linux kernel and VMware ESXi and Workstation flaws to its Known Exploited Vulnerabilities catalog
• borncity.com: 0-day vulnerabilities in VMWare ESXi, Workstation and Fusion
• socradar.io: VMware Security Alert: Active Exploitation of Zero-Day Vulnerabilities (CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226)
• Arctic Wolf: Three VMware Zero-Days Exploited in the Wild Patched by Broadcom
• Blog: Multiple zero-days in VMware products actively exploited
• gbhackers.com: CISA Issues Alert on Actively Exploited VMware Vulnerabilities
• www.tenable.com: CVE-2025-22224, CVE-2025-22225, CVE-2025-22226: Zero-Day Vulnerabilities in VMware ESXi, Workstation and Fusion Exploited
• Information Security Buzz: Broadcom warns VMware users of Critical Zero-Day Exploits
• www.cybersecuritydive.com: 37K+ VMware ESXi instances vulnerable to critical zero-day
• www.itpro.com: Broadcom issues urgent alert over three VMware zero-days
• Carly Page: Broadcom is warning that a trio of VMware vulnerabilities are being actively exploited by hackers to compromise the networks of its corporate customers
• techcrunch.com: Security experts warn of ‘huge impact’ of actively exploited hypervisor flaws that allow sandbox escape
• Security Risk Advisors: Three Critical VMware Vulnerabilities Exploited in Wild Targeting ESXi, Workstation, and Fusion
• www.cybersecuritydive.com: Broadcom urges customers to patch 3 zero-day VMware flaws
• MSSP feed for Latest: Broadcom: VMware Zero-Days Being Exploited in the Wild
• www.bleepingcomputer.com: Over 37,000 internet-exposed VMware ESXi instances are vulnerable to CVE-2025-22224, a critical out-of-bounds write flaw that is actively exploited in the wild.
• research.kudelskisecurity.com: Critical VMware ESXi, Workstation, Fusion Vulnerabilities Seen Exploited in Wild
• cyble.com: Three VMware Zero-Days Under Active Exploitation – What You Need to Know
• Zack Whittaker: VMware emergency hypervisor escape bugs under attack

Classification:

• HashTags: #VMware #SecurityPatch #Vulnerability
• Company: VMware
• Target: VMware ESXi users
• Product: ESXi
• Feature: Security Patches
• Type: Vulnerability
• Severity: Critical