CVE-2025-22225: VMware ESXi VMX arbitrary write enables sandbox escape

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is a confirmed exploited hypervisor sandbox escape in CISA KEV with known ransomware use, though exploitation requires high privileges inside the VMX process.

What it is

VMware ESXi contains an arbitrary write vulnerability in which a malicious actor with privileges within the VMX process can trigger an arbitrary kernel write. This breaks the VMX sandbox boundary, letting a guest-side attacker reach the hypervisor kernel. It matters because ESXi is a core virtualization platform and the flaw is listed in CISA KEV.

Impact

An attacker with VMX process privileges gains arbitrary kernel write on the ESXi host, escaping the VM sandbox and potentially compromising the hypervisor and all hosted workloads.

Attack surface

The vector is local (AV:L) with high privileges required (PR:H) and no user interaction (UI:N), meaning the attacker must already hold privileges inside the VMX process. It is not remotely reachable without that foothold.

Exploitation

CISA added it to KEV on 2025-03-04 with a due date of 2025-03-25 and flags known ransomware campaign use, indicating exploitation in the wild. EPSS is low at roughly 1 percent (61st percentile), so mass scanning is unlikely, but targeted abuse is confirmed.

What to do

• Apply the Broadcom/VMware vendor advisory patches for ESXi, Cloud Foundation, Telco Cloud Infrastructure and Telco Cloud Platform immediately.
• Follow CISA BOD 22-01 guidance for cloud services and meet the 2025-03-25 KEV remediation deadline.
• Restrict and audit who can administer VMs and the VMX process; reduce privileged VM operator accounts.
• If patching is not possible, isolate affected hosts and discontinue use per vendor instructions.
• Monitor ESXi hosts for unexpected kernel writes or VMX process anomalies after patching.

Detection

• Monitor ESXi host logs and VMX process activity for unexpected privilege changes or crashes.
• Alert on unusual kernel-level write activity or memory corruption indicators on ESXi hosts.
• Track KEV status and verify patch compliance across all ESXi, Cloud Foundation and Telco Cloud assets.
• Correlate VM operator account activity with host-level anomalies to catch sandbox escape attempts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.