Loading story…
Broadcom released fixes for three actively exploited VMware zero-day vulnerabilities affecting ESXi, Workstation, and Fusion, warning that the bugs can be chained to achieve a full virtual machine escape from a guest system to the hypervisor. The flaws, tracked as CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226, include a critical issue and can enable code execution, sandbox escape, and access to sensitive memory when an attacker already has administrative privileges inside a guest VM. Microsoft Threat Intelligence Center reported the in-the-wild exploitation, and security researchers described the campaign as ESXicape.
Affected products include unpatched VMware ESXi 7.0 and 8.0, VMware Workstation 17.x before 17.6.3, and VMware Fusion 13.x before 13.6.3. Organizations running VMware Cloud Foundation environments may need to account for Broadcom’s product-specific patching requirements and compatibility constraints when deploying updates, including cases where some component updates are handled through the in-product Flexible BOM rather than the Async Patch Tool. Defenders are being urged to apply the relevant ESXi patches immediately and upgrade desktop hypervisor products to the fixed releases to block guest-to-host compromise.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Broadcom released security updates for VMware ESXi, Workstation, and Fusion to fix the actively exploited vulnerabilities CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226. The fixes include ESXi patches and upgrades to Workstation 17.6.3 and Fusion 13.6.3.
Microsoft Threat Intelligence Center reported active exploitation of three VMware vulnerabilities, CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226. The flaws could be chained from a guest VM with administrative privileges to achieve a full VM escape.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
csirt.sk
Open sourcedoublepulsar.com
Open sourceknowledge.broadcom.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Broadcom released **VMSA-2026-0006** to patch five vulnerabilities affecting **VMware vCenter, ESXi, Workstation, and Fusion**, including three critical flaws. The most severe issues are **`CVE-2026-59309`** and **`CVE-2026-59310`**, both rated **CVSS 9.8**, which can be exploited remotely against **vCenter** by an unauthenticated attacker with network access to bypass authentication or achieve remote code execution. Broadcom said there are **no workarounds** and urged organizations to prioritize patching, particularly for externally reachable or broadly accessible vCenter deployments. The advisory also fixes **`CVE-2026-47876`**, a critical **VM escape** in ESXi’s **VMXNET3** virtual network adapter that could let an attacker with local administrative privileges inside a guest VM execute arbitrary code on the ESXi host. Two additional flaws were patched: **`CVE-2026-41703`**, a high-severity issue affecting ESXi, Workstation, and Fusion that can cause information disclosure or, more likely, denial of service, and **`CVE-2026-41709`**, a low-severity ESXi logging-related bug. Broadcom said it is **not aware of in-the-wild exploitation** and published patching guidance and an FAQ for affected customers.
Aug 3, 2026
Broadcom has released emergency patches for **`CVE-2026-47876`**, a critical **out-of-bounds write** flaw in the **VMXNET3** virtual network adapter used by VMware ESX environments. The vulnerability, rated **CVSS 9.3** and mapped to **`CWE-787`**, allows an attacker with **local administrator or root privileges inside a guest VM** using VMXNET3 to execute code on the underlying host, creating a **guest-to-host escape** condition. Affected offerings include **VMware ESX**, **VMware Cloud Foundation**, **VMware vSphere Foundation**, and **VMware Telco Cloud Platform** across specified version ranges. Broadcom said there is **no evidence of active exploitation**, no complete workaround, and no published indicators of compromise, increasing pressure on defenders to apply vendor fixes quickly. Security researchers warned that successful exploitation could break VM isolation and expose the hypervisor, adjacent virtual machines, management systems, workloads, and infrastructure secrets, particularly in multi-tenant environments. The flaw was privately reported by **Nguyen Hoang Thach of STARLabs SG** through **Pwn2Own** and the **Zero Day Initiative**, and organizations are being urged to patch affected builds immediately and treat any privileged compromise of a VMXNET3-enabled guest on an unpatched host as a potential hypervisor incident.
Aug 1, 2026
Broadcom issued **VMSA-2025-0010** to fix four vulnerabilities across VMware ESXi, vCenter Server, Workstation, Fusion, Cloud Foundation, Telco Cloud Platform, and Telco Cloud Infrastructure, led by **CVE-2025-41225**, an authenticated command-execution flaw in **vCenter Server** with a **CVSS 8.8** score. According to the advisory, an attacker able to create or modify alarms and run script actions could exploit the bug, while additional fixes address **CVE-2025-41226** and **CVE-2025-41227** denial-of-service issues and **CVE-2025-41228**, a reflected **XSS** flaw affecting ESXi and vCenter Server. VMware said patches are available for all affected products and that **no workarounds** exist. The latest advisory follows earlier VMware warnings over serious **vCenter Server** weaknesses, including **VMSA-2024-0012**, which disclosed **CVE-2024-37079**, **CVE-2024-37080**, and **CVE-2024-37081** as memory-management and corruption flaws that could enable **remote code execution** in vCenter services. VMware said at the time it had no evidence of active exploitation, but urged customers to apply the listed patch versions because no official mitigations were provided; public GitHub material later appeared referencing **CVE-2024-37081**, underscoring continued security attention on vCenter exposure.
Jun 29, 2026