CVE-2025

Securityaffairs.Co •Pierluigi Paganini • February 4, 2026

Ransomware groups now exploit VMware ESXi vulnerability CVE-2025-22225, patched by Broadcom in March 2025. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirms that ransomware gangs are exploiting the VMware ESXi sandbox escape flaw CVE-2025-22225. The vulnerability is an arbitrary write issue in VMware ESXi. An attackers with privileges within the VMX process may trigger an arbitrary […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CISA Confirms Active Exploitation of VMware ESXi CVE-2025-22225 CISA has confirmed the active exploitation of a critical vulnerability in VMware ESXi, tracked as CVE-2025-22225. This zero-day flaw allows attackers to escape security sandboxes and is currently being used in ransomware operations. The vulnerability, classified as an arbitrary write memory issue, was added to CISA's Known Exploited Vulnerabilities catalog on March 4, 2025. 7 sources 20

Extracted Entities

CVE-2025

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

Platforms (1)