Loading story…
Theori published a series of technical disclosures showing how multiple known vulnerabilities could be chained into full-system compromise across enterprise environments. In VMware Workstation, the researchers described CVE-2023-34044, an information leak in the virtual Bluetooth device that exposed uninitialized host memory and could reveal vmware-vmx.exe addresses, and CVE-2023-20869, a stack-based memory corruption flaw in SDP packet handling that enabled guest-to-host code execution through the virtual Bluetooth device. The VMware bugs were presented as parts of a broader escape chain, with related Bluetooth and URB processing details aligning with prior public research from ZDI on VMware Workstation exploitation.
The same research series also examined Windows kernel privilege-escalation bugs in mskssrv.sys, including CVE-2023-29360, which abused MmProbeAndLockPages with KernelMode to gain arbitrary kernel read/write and elevate from medium integrity to SYSTEM, and CVE-2023-36802, a type-confusion flaw that could be turned into a PreviousMode overwrite for SYSTEM-level access. Separately, Theori disclosed four critical flaws in CoSoSys Endpoint Protector—CVE-2024-36072 through CVE-2024-36075—that could be chained from unauthenticated server access to root command execution, plaintext credential theft, and compromise of managed macOS and Windows endpoints; Netwrix, which now owns the product, patched the issues before public disclosure.
Get the actors, campaigns, and ATT&CK mapping behind it.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
6 references tracked. Mallory keeps watching after this page renders.
theori.io
Open sourcetheori.io
Open sourcetheori.io
Open sourcetheori.io
Open sourcetheori.io
Open sourcezerodayinitiative.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Broadcom VMware issued fixes for multiple **Pwn2Own-disclosed** local privilege escalation flaws affecting **ESXi** and **Workstation**, where attackers with code execution inside a guest can potentially execute arbitrary code in the **hypervisor** context. The disclosed issues include **CVE-2025-41236** in the **VMXNET3** virtual device on ESXi, caused by an integer overflow; **CVE-2025-41237** in **VMCI** on ESXi, caused by an integer underflow; and **CVE-2025-41238** in the **PVSCSI** virtual device on Workstation, caused by improper validation of user-controlled length data leading to a heap-based buffer overflow. All three advisories assign a **CVSS 8.2** score and describe the same exploitation precondition: the attacker must already be able to run high-privileged code on the guest OS. The Aria Operations privilege-escalation research is a **different VMware product issue** and does not describe the same disclosure set. That separate report covers **CVE-2025-41245** and **CVE-2026-22721**, where a vCenter user mapped by default to Aria’s **PowerUser** role could escalate to an Aria administrator and potentially gain access across integrated VMware environments. By contrast, the relevant Pwn2Own advisories focus specifically on guest-to-hypervisor escape paths in ESXi and Workstation, with Broadcom publishing updates through the same security advisory channel and crediting researchers from **STAR Labs**, **Synacktiv**, and **REverse Tactics** for the findings.
Jun 29, 2026
Broadcom addressed three high-severity vulnerabilities in VMware products following notification from the National Security Agency (NSA), highlighting the potential national security implications of these flaws. The vulnerabilities, identified as CVE-2025-41250 affecting vCenter Server and CVE-2025-41251 and CVE-2025-41252 affecting VMware NSX, impact a range of VMware products including NSX, NSX-T, VMware Cloud Foundation, VMware vCenter Server, VMware Telco Cloud Platform, and VMware Telco Cloud Infrastructure. Security professionals noted that the NSA's involvement suggests a heightened risk of exploitation by nation-state actors, referencing previous incidents where Russian state-sponsored groups targeted VMware vulnerabilities. The two NSX vulnerabilities allow unauthenticated attackers to enumerate valid usernames on affected systems, which can be leveraged in combination with weak or reused credentials to facilitate deeper network penetration. The vCenter Server vulnerability involves SMTP header injection, which could be used in further attack chains. While there is no public evidence that these specific vulnerabilities have been exploited in the wild, experts warn that their combination could enable attackers to progress from reconnaissance to authenticated compromise. The vulnerabilities were disclosed and patched on September 29, 2025, with Broadcom urging customers to apply updates promptly. In parallel, security researchers at NCC Group have published detailed technical analyses of guest-to-host escape vulnerabilities in VMware Workstation, demonstrating how attackers can exploit information leaks and stack-based buffer overflows to execute code on the host operating system from a compromised guest VM. The research includes proof-of-concept exploit development using tools such as Ghidra and WinDBG, providing valuable insights for red teamers and penetration testers. These findings underscore the ongoing risks associated with virtualization platforms, where vulnerabilities can enable attackers to break out of isolated environments and compromise underlying infrastructure. The technical depth of the NCC Group's research highlights the complexity of exploit development for VMware products and the importance of robust vulnerability management. The combination of newly patched vulnerabilities and active exploit research emphasizes the need for organizations to maintain up-to-date security controls and monitor for signs of suspicious activity in virtualized environments. Security teams are advised to review VMware advisories, apply patches without delay, and consider additional hardening measures for critical systems. The involvement of intelligence agencies in vulnerability disclosure further illustrates the strategic importance of securing virtualization technologies in both enterprise and government contexts. Organizations should also be aware of the potential for these vulnerabilities to be used in targeted attacks, particularly by sophisticated threat actors. Ongoing collaboration between vendors, security researchers, and government agencies remains essential to address emerging threats in the virtualization space.
Jun 29, 2026
Attackers actively exploited **VMware Workspace ONE Access**, **Identity Manager**, and **vRealize Automation** flaws in the wild, with **`CVE-2022-22954`** emerging as the primary initial access vector. Palo Alto Networks Unit 42 said exploitation began shortly after VMware disclosed the issue, describing the bug as a trivial server-side template injection that can be triggered with a single HTTP request for remote code execution. The activity prompted a **CISA alert**, and researchers warned that related VMware flaws **`CVE-2022-22972`** and **`CVE-2022-22973`** were also highly likely to be targeted. Observed post-exploitation activity included deployment of **Mirai** and **Gafgyt** variants, **Enemybot**, webshells, Perl-based shellbots, coinminers, and payloads that modified SSH keys for persistence. Unit 42 reported that attackers could chain **`CVE-2022-22960`** after the initial compromise to escalate privileges to root by abusing writable paths and sudo-accessible scripts. The company said its Threat Prevention signature **`92483`** blocks exploitation attempts and noted that **about 800 internet-exposed Workspace ONE Access instances** were visible, underscoring the exposure risk for unpatched organizations.
Jun 29, 2026