What breaks and who should care
If your environment runs VMware ESXi, the vulnerability identified as CVE-2025-22225 could let an attacker escape the virtual machine sandbox and write to the hypervisor kernel. That means a malicious guest could gain control of the host, potentially compromising every VM on that server. Any organisation that relies on ESXi for production workloads, testing labs, or even a single‑purpose appliance should treat this as a high‑priority issue.
Related remediation guides
Other vulnerabilities in the same family or affecting the same products:
- MetInfo CMS CVE-2026-29014 Exploit: Critical Security Flaw Bypasses Authentication
- Critical nginx vulnerability CVE-2026-42533 patched
- CVE-2026-43284 – Linux kernel ESP‑in‑UDP in‑place decryption flaw
For the wider picture, our Known Exploited Vulnerabilities tracker lists every flaw CISA has confirmed under active attack.
Why the vulnerability matters
The Common Vulnerability Scoring System gives this flaw an 8.2 – high – rating. The score reflects the fact that an attacker only needs to be inside the VMX process – a privileged component of the hypervisor – to trigger an arbitrary write. Once that write succeeds, the attacker can execute code in kernel space, break out of the VM, and take over the host. In the hands of ransomware operators, that capability translates directly into a rapid, wide‑scale encryption of data across all tenants on the compromised host.
How the vulnerability works
The NVD description is brief: “VMware ESXi contains an arbitrary write vulnerability. Successful exploitation allows an attacker with privileges within the VMX process to trigger an arbitrary kernel write leading to an escape of the sandbox.” In plain English, the bug resides in the part of ESXi that mediates access between a virtual machine and the physical hardware. When a guest asks the VMX process to perform a certain operation, the hypervisor fails to correctly validate the request, opening a path to write any value to any kernel address.
Because the exact exploit chain has not been published, we can only describe the class of the flaw. It is an arbitrary write bug – a subset of memory‑corruption vulnerabilities where the attacker can control both the data written and the destination address. When combined with the privileged nature of the VMX process, that control becomes a powerful tool for privilege escalation.
Security researchers have confirmed that the technique works in the wild. CISA added CVE-2025-22225 to its Known Exploited Vulnerabilities catalog on the day it was published, and the agency has recorded its use in ransomware campaigns. That confirmation means the risk is not theoretical – threat actors are actively hunting for vulnerable ESXi hosts.
How to tell if you are exposed
First, verify that you are actually running ESXi. On the host console, or via SSH, run:
esxcli system version getThe command prints the product name and build information. If you see “VMware ESXi” in the output, the host is in scope for this advisory.
Next, you need to know whether your specific build is covered by a patch. The National Vulnerability Database does not publish a list of affected or fixed releases for this CVE. Instead, VMware provides a matrix that maps each release branch to a patched build. That matrix is rendered automatically on the vendor advisory page – you will see it as “the table below” on this reference page. Compare the build identifier you obtained from esxcli system version get with the entries in that table. If your build appears in the “affected” column, you are vulnerable.
If you cannot access the table for any reason, the safest assumption is that you are at risk until you have applied the vendor‑supplied mitigation.
Mitigation options
CISA’s guidance is explicit: you must either apply the vendor’s mitigation, follow the applicable BOD 22‑01 guidance for cloud services, or discontinue use of the product if a fix is unavailable. The following steps cover each path.
1. Apply the vendor patch
VMware releases patches as part of its regular update streams. The remediation for CVE-2025-22225 is delivered as a patched build for each supported branch. The instruction is simple: upgrade to the patched release for your branch. Do not guess a version number – use the update mechanism built into ESXi.
- Log into the vSphere Client.
- Navigate to Host > Updates.
- Check for “Security Patch” entries that reference CVE-2025-22225.
- Select the patch and click Install. The host will reboot to apply the update.
If you manage ESXi hosts with vCenter, you can push the patch to multiple hosts at once via the Update Manager. The same principle applies: select the security patch that addresses CVE-2025-22225 and schedule installation during a maintenance window.
2. Apply vendor‑provided mitigations without a full upgrade
In some cases, VMware may issue a temporary configuration change that blocks the vulnerable code path. Those mitigations are documented in the advisory and typically involve setting a hypervisor flag or disabling a specific feature.
Example command (replace FLAG_NAME with the name shown in the advisory):
esxcli system settings advanced set -o /UserVars/FLAG_NAME -i 1After applying the setting, restart the management agents:
/etc/init.d/hostd restart && /etc/init.d/vpxa restartRemember, a mitigation is not a substitute for a full patch. It buys you time while you plan the upgrade.
3. Follow BOD 22‑01 guidance for cloud services
If your ESXi hosts are part of a public or hybrid cloud offering, the Department of Commerce’s Binding Operational Directive 22‑01 provides additional steps. Those include isolating the affected host, monitoring for suspicious activity, and ensuring that any compromised VM snapshots are examined. The directive does not replace the need for a patch, but it adds layers of defence while you work on remediation.
4. Discontinue use if you cannot patch
Should you be unable to apply a patch or mitigation – for example, because the host runs legacy hardware that cannot support the new build – the safest course is to retire the system. Move workloads to a supported platform and de‑commission the vulnerable ESXi host. Running an unpatched hypervisor that is known to be exploitable is a liability you cannot afford.
Step‑by‑step remediation checklist
- Identify ESXi hosts. Run
esxcli system version geton each server. - Check the table below. Compare the build identifier with the entries in the vendor’s affected/fixed matrix.
- If affected, plan an upgrade. Use the vSphere Client or vCenter Update Manager to install the security patch that addresses CVE-2025-22225.
- If you cannot upgrade immediately, apply the temporary mitigation. Follow the exact command line shown in the advisory.
- Validate the fix. After reboot, run
esxcli system version getagain and confirm the build now appears in the “fixed” column of the table. - Document the change. Record the patch level, the date applied, and any mitigation flags set.
- Monitor for indicators of compromise. Look for unusual VM exits, unexpected kernel logs, or outbound traffic from the host that matches known ransomware patterns.
What to do if a patch is unavailable
In the unlikely event that VMware has not yet released a patched build for your branch, you have two practical options:
- Isolate the host. Move it out of production, disable network interfaces, and restrict console access.
- Deploy a compensating control. Use a host‑based intrusion detection system that can flag attempts to write to privileged kernel memory. While not a perfect defence, it raises the bar for an attacker.
Simultaneously, open a support ticket with VMware. Ask for an estimated timeline for a fix and for any additional hardening steps they recommend.
Why you should act now
The combination of a high CVSS score, confirmed exploitation, and ransomware use makes CVE-2025-22225 a clear and present danger. An attacker who gains kernel control on one ESXi host can pivot to other hosts on the same network, exfiltrate data, and launch encryption attacks that bring down entire services.
Delaying remediation increases the window of opportunity for threat actors. The cost of a single successful ransomware infection – lost productivity, downtime, potential ransom payment, and reputational damage – far outweighs the effort required to apply a security patch during a scheduled maintenance window.
Summary
• CVE-2025-22225 is an arbitrary write bug in VMware ESXi that enables VM‑to‑host escape.
• The vulnerability is rated 8.2 (high) and has been seen in the wild, including ransomware campaigns.
• No version list is published by NVD; refer to the vendor‑provided matrix (the table below) to see if your build is affected.
• Mitigation steps: upgrade to the patched release for your branch, apply the temporary vendor‑issued flag if you cannot upgrade immediately, follow BOD 22‑01 guidance for cloud deployments, or retire the host if no fix is possible.
• Verify your host’s build with esxcli system version get and confirm remediation by re‑checking the table after the update.
Table of affected and fixed releases
The table below is generated automatically from the National Vulnerability Database and shows which ESXi builds are vulnerable and which contain the fix for CVE-2025-22225. Use it in conjunction with the commands above to decide your next steps.
Affected versions
NVD has not published machine-readable version ranges for CVE-2025-22225 yet. Check the vendor advisory for the exact affected and fixed releases before you plan an upgrade.
