CISA Warns of Ransomware Exploiting VMware ESXi Vulnerability CVE-2025-22225
- Securityish
- Threats & Incidents
Quick Summary
CISA has confirmed that ransomware gangs are exploiting a high-severity VMware ESXi vulnerability, tracked as CVE-2025-22225, which allows arbitrary kernel writes. This flaw, discovered in March 2025, affects multiple VMware products, including ESXi and vSphere, and has been used in sophisticated zero-day attacks since at least February 2024. Organizations using VMware products should take immediate action to secure their systems to prevent potential data breaches.
The Securityish Brief
CISA recently reported that ransomware groups have begun exploiting a critical vulnerability in VMware ESXi, identified as CVE-2025-22225. This flaw allows attackers with privileges within the VMX process to perform arbitrary kernel writes, leading to a sandbox escape. Broadcom, the vendor responsible for VMware products, patched this vulnerability along with two others in March 2025, marking them as actively exploited zero-days.
These vulnerabilities not only affect VMware ESXi but also impact other products such as VMware Fusion, Cloud Foundation, vSphere, Workstation, and Telco Cloud Platform. The vulnerabilities were reportedly chained by Chinese-speaking threat actors in sophisticated attacks since at least February 2024, indicating a significant risk to organizations using these platforms.
In a recent update, CISA added CVE-2025-22225 to its Known Exploited Vulnerabilities (KEV) catalog, emphasizing its use in ongoing ransomware campaigns. Although specific details about these attacks were not disclosed, the agency’s warning highlights the urgency for organizations to secure their systems.
Organizations using VMware products should take note of the Binding Operational Directive (BOD) 22-01, which mandates federal agencies to secure their systems by March 25, 2025. This directive underscores the critical nature of the vulnerability and the potential for significant data breaches if left unaddressed.
Ransomware gangs frequently target VMware vulnerabilities due to their widespread deployment in enterprise environments, which often house sensitive corporate data. For example, CISA previously ordered government agencies to patch another high-severity vulnerability in VMware Tools that had been exploited since October 2024.
Additionally, CISA has flagged a critical VMware vCenter Server vulnerability as actively exploited, further illustrating the ongoing threat landscape surrounding VMware products. Organizations must remain vigilant and proactive in their cybersecurity measures to mitigate these risks.
Practical Implications for Organizations
Given the critical nature of these vulnerabilities, organizations should prioritize patching and securing their VMware environments. Regularly reviewing and updating security protocols can help prevent exploitation by ransomware gangs.
Key Takeaways
- Immediately apply patches for CVE-2025-22225 and related vulnerabilities as per vendor instructions.
- Review and enhance security configurations for all VMware products in use.
- Monitor for any unusual activity or signs of exploitation within your systems.
- Educate staff about the risks associated with ransomware and the importance of cybersecurity hygiene.
- Consider discontinuing use of vulnerable products if timely mitigations are not available.
Key Terms & Concepts
- CVE-2025-22225: In this article, CVE-2025-22225 refers to a high-severity VMware ESXi vulnerability that allows arbitrary kernel writes.
- Zero-day: A zero-day is a vulnerability that is exploited before the vendor releases a patch.
- Ransomware: Ransomware is a type of malicious software that encrypts a victim’s data and demands payment for its release.
- Binding Operational Directive (BOD) 22-01: BOD 22-01 is a directive from CISA mandating federal agencies to secure their systems against known vulnerabilities.
Read the original article here: https://www.bleepingcomputer.com/news/security/cisa-vmware-esxi-flaw-now-exploited-in-ransomware-attacks/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
