VMware ESXi CVE-2025-22225: VM Escape Used in Ransomware

What to do

1. Run esxcli system version get (or vmware -vl) on every host and compare the build with the fixed builds.
2. Patch every ESXi 7.0 and 8.0 host to at least the March 2025 builds, and preferably the current release.
3. Plan the replacement of any ESXi 6.x or older host; it gets no fix and the known exploit targets builds back to 5.1.
4. Treat admin rights inside any VM as a path to the host: tighten VPN and domain admin access, which is how the documented intrusion reached the VMs.
5. If a host was unpatched while exposed VMs were compromised, run the hunt below and consider reinstalling the host.

How to check if you are affected or compromised

• On ESXi, run lsof -a and look for unexpected processes with open SOCKET_VMCI entries, which Huntress says marks the VSOCKpuppet backdoor.
• Check ESXi hosts for unexpected files in /var/run/ (the backdoor was written to /var/run/a), changes to /etc/inetd.conf, and unexpected listeners on port 21.
• In Windows guests, hunt for devcon.exe disabling the VMCI device, KDU or other vulnerable-driver loads, and InfDefaultInstall.exe installing vmci.inf or vsock.inf from unusual paths.
• Match files against the SHA-256 hashes Huntress published for MAESTRO, MyDriver.sys, VSOCKpuppet and the GetShell client.

What happened#

On March 4, 2025, Broadcom published VMSA-2025-0004 for three VMware bugs that Microsoft Threat Intelligence Center reported. Broadcom said it had information suggesting all three had been exploited in the wild. CVE-2025-22224 (CVSS 9.3) is a time-of-check/time-of-use heap overflow in VMCI. It lets a local admin in a VM run code as the host's VMX process. CVE-2025-22226 (7.1) is an out-of-bounds read in HGFS that leaks VMX memory. CVE-2025-22225, the subject of this brief, is an ESXi arbitrary write. An actor with privileges in the VMX process "may trigger an arbitrary kernel write leading to an escape of the sandbox," per the CVE record. Broadcom scores it 8.2, and NVD agrees. There is no workaround. CISA added all three to KEV the same day.

The fullest public account came later. On January 7, 2026, Huntress described a December 2025 intrusion that likely began through a compromised SonicWall VPN. The attacker used a stolen domain admin account, then ran a toolkit on a domain controller VM that escaped to the ESXi host. An orchestrator Huntress calls MAESTRO disables the guest's VMCI driver and loads an unsigned driver through KDU. The driver leaks a VMX address, writes shellcode into VMX and finally escapes to the host. There it installs VSOCKpuppet, a backdoor that listens on VSOCK port 10000 and is invisible to network monitoring. Huntress maps the three stages, with moderate confidence, to CVE-2025-22226, CVE-2025-22224 and CVE-2025-22225. A PDB path dated February 19, 2024 suggests the exploit was built as a zero-day more than a year before disclosure. Huntress assesses the developer as well-resourced and likely in a Chinese-speaking region. The exploit carries offsets for 155 ESXi builds from 5.1 to 8.0.

On February 4, 2026, CISA flagged CVE-2025-22225 as known to be used in ransomware campaigns, BleepingComputer reported. No group was named as of October 23, 2026.

Who is affected#

ESXi 8.0 before ESXi80U3d-24585383 (U2 line: ESXi80U2d-24585300), ESXi 7.0 before ESXi70U3s-24585291, and the Cloud Foundation and Telco Cloud products built on them. End-of-life ESXi 6.x and older get no fix. Workstation and Fusion are not affected by this CVE.

Do you really need to act?#

Check, and take it seriously. An attacker needs admin inside a VM first, so this is not an internet-facing hole. But that precondition is common: a phished domain admin, a compromised web server VM or a tenant. A working escape turns it into control of every VM on the host, which is exactly what ransomware crews want. Hosts patched in March 2025 are fine for this chain. Unpatched 7.0 and 8.0 hosts, and every surviving 6.x host, are not. Separately, CVE-2024-37085, an ESXi Active Directory authentication bypass, is also in KEV with ransomware use.

What to do now#

1. Run esxcli system version get or vmware -vl on every host and compare the build numbers above.
2. Patch 7.0 and 8.0 hosts to at least the March 2025 builds, and preferably the current release.
3. Replace or isolate any ESXi 6.x or older host.
4. Harden the paths to admin inside VMs: VPN, domain admin accounts and remote access.

How to tell if you were hit#

On hosts, run lsof -a and look for unknown processes holding SOCKET_VMCI entries. Look for unexpected files in /var/run/, edits to /etc/inetd.conf and listeners on port 21. In Windows guests, hunt for devcon.exe disabling VMCI, KDU or vulnerable driver loads, and InfDefaultInstall.exe installing vmci.inf or vsock.inf. Huntress published SHA-256 hashes plus YARA and Sigma references.

Timeline#

• Feb 19, 2024 — Date in the exploit driver's PDB path, per Huntress.
• Mar 4, 2025 — Broadcom publishes VMSA-2025-0004; CISA adds all three CVEs to KEV.
• Jan 7, 2026 — Huntress documents the escape toolkit from a December 2025 intrusion.
• Feb 4, 2026 — CISA marks CVE-2025-22225 as used in ransomware.

Vulnerability records

• CVE-2025-22225 · KEV 2025-03-04 · VMware ESXi contains an arbitrary write vulnerability.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Broadcom — VMSA-2025-0004: VMware ESXi, Workstation, and Fusion updates address multiple vulnerabilities support.broadcom.com
2. CVE record — CVE-2025-22225 cve.org
3. NVD — CVE-2025-22225 nvd.nist.gov
4. CISA — Known Exploited Vulnerabilities: CVE-2025-22225 cisa.gov
5. Huntress — ESXi VM escape exploit (Jan 7, 2026) huntress.com

Coverage and analysis

1. BleepingComputer — CISA: VMware ESXi flaw now exploited in ransomware attacks bleepingcomputer.com