CISA Flags VMware ESXi CVE-2025-22225 as Exploited in Ransomware Campaigns

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) updated its Known Exploited Vulnerabilities (KEV) catalog to indicate that CVE-2025-22225, a high-severity VMware ESXi VMX sandbox escape flaw, is now known to be used in ransomware campaigns. Broadcom patched the issue in March 2025 as part of advisory VMSA-2025-0004, describing CVE-2025-22225 as an arbitrary kernel write reachable by an attacker with privileges in the VMX process, enabling escape from the VMX sandbox to the ESXi kernel. The same advisory also addressed two other zero-days—CVE-2025-22224 (TOCTOU leading to out-of-bounds write/code execution as the VMX process) and CVE-2025-22226 (HGFS out-of-bounds read/memory disclosure)—which Broadcom previously tagged as actively exploited in the wild.

Reporting also tied the ESXi exploitation to earlier sophisticated activity: Huntress described Chinese-speaking threat actors leveraging access via a compromised SonicWall VPN to deliver tooling targeting VMware ESXi and chaining a VM escape technique that appeared to predate public disclosure of the March 2025 ESXi zero-days. Separately, GreyNoise research highlighted a broader KEV-catalog visibility gap, finding that CISA quietly “flipped” dozens of KEV entries during 2025 from “Unknown” to “Known” for ransomware use without prominent public notification—an approach that can materially affect enterprise prioritization when a vulnerability’s status changes to confirmed ransomware exploitation.