VMware ESXi flaws exploited in wild
Multiple VMware ESXi, Workstation, and Fusion vulnerabilities enabling local code execution are being actively exploited, requiring immediate patching.
Sourcecisecurity.org — open the original
What to check
- Applies to
- The 3 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226 as exploited in the wild.
VMware has disclosed multiple critical vulnerabilities in ESXi, Workstation, and Fusion products that allow local attackers to execute arbitrary code with administrator privileges. The most severe flaws include CVE-2025-22224, a time-of-check time-of-use (TOCTOU) vulnerability leading to out-of-bounds write in ESXi and Workstation, and CVE-2025-22225, an arbitrary write vulnerability in ESXi. A lower-severity information disclosure issue (CVE-2025-22226) affecting HGFS was also patched.
Successful exploitation enables attackers with local access to execute code as administrator, install malware, manipulate data, or create privileged accounts. The vulnerabilities affect widely deployed versions including ESXi 8.0 and 7.0, Workstation 17.x, Fusion 13.x, and multiple VMware Cloud Foundation and Telco Cloud Platform releases.
VMware has confirmed that active exploitation has occurred in the wild, elevating the urgency for organizations running affected virtualization infrastructure. Immediate patching is critical, particularly for ESXi hosts which form the backbone of enterprise virtualization environments and are high-value targets for threat actors seeking persistent access to virtual machine workloads.
Mentioned in this report
Detection guidance
Shell Interpreter Spawned by ESXi Core Processes (Possible CVE-2025-22224/22225 Exploitation)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a shell (sh/ash/busybox) being spawned as a child of ESXi hypervisor management processes (hostd, vmx), which can indicate local privilege escalation via the ESXi TOCTOU/arbitrary-write vulnerabilities leading to code execution as root. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Shell Interpreter Spawned by ESXi Core Processes
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|contains:
- hostd
- vmx
- vmkfstools
shell_child:
Image|endswith:
- /sh
- /ash
- /bash
- /busybox
filter:
CommandLine|contains:
- vim-cmd
- /usr/lib/vmware/hostd/
condition: selection and shell_child and not filter
falsepositives:
- Legitimate VMware Tools or lifecycle scripts invoked internally by hostd during
normal VM operations
- Scheduled maintenance scripts that call vim-cmd helpers spawning shell wrappers
level: high
tags:
- attack.t1059
- attack.execution
id: 26d5ad0c-219a-59a9-98f1-1e6adcce36b7
status: experimental
author: Vorant
ESXi Shell or SSH Service Enabled via CLI Utilities
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects use of esxcli/vim-cmd to enable ESXi Shell (Tech Support Mode) or SSH access, a common follow-on action after exploiting local privilege-escalation flaws to gain persistent interactive command execution on the hypervisor. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: ESXi Shell or SSH Enabled via Administrative CLI
logsource:
category: process_creation
product: linux
detection:
selection_vimcmd:
CommandLine|contains:
- vim-cmd hostsvc/enable_ssh
- vim-cmd hostsvc/start_ssh
selection_esxcli:
CommandLine|contains:
- esxcli system settings advanced set -o /UserVars/ESXiShellEnabled
- esxcli system settings advanced set -o /UserVars/ESXiShellTimeOut
condition: 1 of selection_*
falsepositives:
- Authorized administrators temporarily enabling ESXi Shell/SSH for maintenance or
troubleshooting via documented change control
level: medium
tags:
- attack.t1059
- attack.persistence
id: dcbd5c1e-cdfd-5dc0-a710-068cef334738
status: experimental
author: Vorant
Privileged Account Creation Following Local ESXi Exploitation
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects local account creation commands executed on an ESXi host shortly after shell access is obtained, consistent with post-exploitation persistence following abuse of CVE-2025-22224/22225 to gain administrator code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Local Account Creation on ESXi Host via CLI
logsource:
category: process_creation
product: linux
detection:
selection:
Image|endswith:
- /esxcli
CommandLine|contains:
- system account add
- system permission set
condition: selection
falsepositives:
- Legitimate administrative onboarding of new service or admin accounts through approved
change management
level: medium
tags:
- attack.t1059
- attack.persistence
- attack.privilege-escalation
id: d7da721f-77b9-5b78-af14-f8b04321b24f
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs