CISA confirms exploitation of VMware ESXi flaw by ransomware attackers
CVE-2025-22225, a VMware ESXi arbitrary write vulnerability, is being used in ransomware campaigns, CISA confirmed on Wednesday by updating the vulnerability’s entry in its Known Exploited Vulnerabilities (KEV) catalog. Researchers linked VMware ESXi zero-day trio to single exploit toolkit Broadcom fixed CVE-2025-22225, CVE-2025-22224 (a heap overflow vulnerability) and CVE-2025-22226 (an information disclosure flaw) in VMware ESXi, Workstation, and Fusion in early March 2025. At the time of their disclosure, Broadcom said that they have information to suggest that the three vulnerabilities have been exploited in the wild as zero-days, but details about the attacks were not shared. The three flaws were added to CISA’s KEV catalog on the same day. In January 2026, Huntress researchers observed attackers using an exploit toolkit they believe takes advantage of all three vulnerabilities. “Based on our analysis of the exploit’s behavior, its use of HGFS for information leaking, VMCI ...