VMware ESXi flaws exploited in wild
Multiple VMware ESXi, Workstation, and Fusion vulnerabilities enabling local code execution are being actively exploited, requiring immediate patching.
VMware has disclosed multiple critical vulnerabilities in ESXi, Workstation, and Fusion products that allow local attackers to execute arbitrary code with administrator privileges. The most severe flaws include CVE-2025-22224, a time-of-check time-of-use (TOCTOU) vulnerability leading to out-of-bounds write in ESXi and Workstation, and CVE-2025-22225, an arbitrary write vulnerability in ESXi. A lower-severity information disclosure issue (CVE-2025-22226) affecting HGFS was also patched.
Successful exploitation enables attackers with local access to execute code as administrator, install malware, manipulate data, or create privileged accounts. The vulnerabilities affect widely deployed versions including ESXi 8.0 and 7.0, Workstation 17.x, Fusion 13.x, and multiple VMware Cloud Foundation and Telco Cloud Platform releases.
VMware has confirmed that active exploitation has occurred in the wild, elevating the urgency for organizations running affected virtualization infrastructure. Immediate patching is critical, particularly for ESXi hosts which form the backbone of enterprise virtualization environments and are high-value targets for threat actors seeking persistent access to virtual machine workloads.
Mentioned in this report
Detection guidance
Shell Interpreter Spawned by ESXi Core Processes (Possible CVE-2025-22224/22225 Exploitation)
Detects a shell (sh/ash/busybox) being spawned as a child of ESXi hypervisor management processes (hostd, vmx), which can indicate local privilege escalation via the ESXi TOCTOU/arbitrary-write vulnerabilities leading to code execution as root. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Shell Interpreter Spawned by ESXi Core Processes
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|contains:
- hostd
- vmx
- vmkfstools
shell_child:
Image|endswith:
- /sh
- /ash
- /bash
- /busybox
filter:
CommandLine|contains:
- vim-cmd
- /usr/lib/vmware/hostd/
condition: selection and shell_child and not filter
falsepositives:
- Legitimate VMware Tools or lifecycle scripts invoked internally by hostd during
normal VM operations
- Scheduled maintenance scripts that call vim-cmd helpers spawning shell wrappers
level: high
tags:
- attack.t1059
- attack.execution
id: 26d5ad0c-219a-59a9-98f1-1e6adcce36b7
status: experimental
author: Vorant
ESXi Shell or SSH Service Enabled via CLI Utilities
Detects use of esxcli/vim-cmd to enable ESXi Shell (Tech Support Mode) or SSH access, a common follow-on action after exploiting local privilege-escalation flaws to gain persistent interactive command execution on the hypervisor. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: ESXi Shell or SSH Enabled via Administrative CLI
logsource:
category: process_creation
product: linux
detection:
selection_vimcmd:
CommandLine|contains:
- vim-cmd hostsvc/enable_ssh
- vim-cmd hostsvc/start_ssh
selection_esxcli:
CommandLine|contains:
- esxcli system settings advanced set -o /UserVars/ESXiShellEnabled
- esxcli system settings advanced set -o /UserVars/ESXiShellTimeOut
condition: 1 of selection_*
falsepositives:
- Authorized administrators temporarily enabling ESXi Shell/SSH for maintenance or
troubleshooting via documented change control
level: medium
tags:
- attack.t1059
- attack.persistence
id: dcbd5c1e-cdfd-5dc0-a710-068cef334738
status: experimental
author: Vorant
Privileged Account Creation Following Local ESXi Exploitation
Detects local account creation commands executed on an ESXi host shortly after shell access is obtained, consistent with post-exploitation persistence following abuse of CVE-2025-22224/22225 to gain administrator code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Local Account Creation on ESXi Host via CLI
logsource:
category: process_creation
product: linux
detection:
selection:
Image|endswith:
- /esxcli
CommandLine|contains:
- system account add
- system permission set
condition: selection
falsepositives:
- Legitimate administrative onboarding of new service or admin accounts through approved
change management
level: medium
tags:
- attack.t1059
- attack.persistence
- attack.privilege_escalation
id: d7da721f-77b9-5b78-af14-f8b04321b24f
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free