VMware Issues Critical Security Advisory: Three Zero-Day Vulnerabilities Exploited

By /

Listen to this Post

VMware has issued an urgent security advisory, warning customers of three actively exploited zero-day vulnerabilities affecting VMware ESXi, Workstation, and Fusion products. These flaws, ranging in severity from important to critical, pose significant security risks and demand immediate patching, as no workarounds are available.

Discovered by Microsoft Threat Intelligence Center, the vulnerabilities allow threat actors to execute malicious code, escape virtual machine sandboxes, and access sensitive memory data. Although the identities of the attackers remain unknown, the ongoing exploitation underscores the persistent threat of software vulnerabilities being leveraged by cybercriminals and state-sponsored hackers.

Organizations using affected VMware products must act quickly to mitigate potential breaches and protect their virtual environments from compromise.

VMware’s March 4 Security Advisory

  • Three Zero-Day Vulnerabilities: Actively exploited flaws in VMware ESXi, Workstation, and Fusion.
  • CVE-2025-22224 (Severity: Critical, CVSS 9.3): A heap-overflow vulnerability in VMware ESXi and Workstation, allowing code execution on the host system.
  • CVE-2025-22225 (Severity: Important, CVSS 8.2): An arbitrary write vulnerability in VMware ESXi that enables sandbox escape.
  • CVE-2025-22226 (Severity: Important, CVSS 7.1): An out-of-bounds read vulnerability in HGFS, leading to information disclosure.
  • Exploitation Confirmed: Microsoft Threat Intelligence Center identified ongoing attacks leveraging these vulnerabilities.
  • No Workarounds Available: Users must apply security patches immediately to protect their systems.
  • Growing Threat Landscape: Similar exploits have been used by ransomware groups like Helldown and Play, as well as Chinese state-sponsored hackers targeting software vulnerabilities in 2024.

What Undercode Say: A Deeper Analysis

The Growing Threat of Virtualization Attacks

Virtualization technology, widely used in enterprise IT infrastructure, has become a prime target for cybercriminals. Exploiting vulnerabilities in VMware products enables attackers to bypass security boundaries and gain privileged access to host systems. This trend highlights the need for constant security vigilance and rapid patch management.

Severity Breakdown: Why CVE-2025-22224 is the Most Dangerous

  • The heap-overflow flaw (CVE-2025-22224) is the most critical, scoring 9.3 on the CVSS scale.
  • Attackers with administrative access to a virtual machine can execute arbitrary code on the host system, potentially gaining full control.
  • This vulnerability enables privilege escalation, a key technique for persistent attacks and lateral movement within networks.

The Risk of Arbitrary Kernel Write (CVE-2025-22225)

  • This vulnerability allows attackers to escape the VM sandbox, which is supposed to isolate guest operating systems from the host.
  • Such flaws have historically been used in ransomware attacks, where hackers breach virtual environments to encrypt enterprise systems.
  • With a CVSS score of 8.2, it’s not as severe as CVE-2025-22224 but still poses a significant risk.

Memory Disclosure (CVE-2025-22226): A Stealthy Threat

  • While this flaw may seem less severe, memory disclosure can lead to data leaks and session hijacking.
  • Attackers can extract sensitive information from memory, potentially bypassing authentication mechanisms and gaining deeper access.
  • The CVSS score of 7.1 suggests a moderate risk, but when combined with other vulnerabilities, it becomes part of a dangerous attack chain.

State-Sponsored Threats and Ransomware Groups

  • The Chinese state-sponsored hacking group that exploited Ivanti vulnerabilities in 2024 is part of a broader trend of government-backed cyber espionage.
  • Ransomware operators like Helldown and Play have specifically targeted VMware environments, indicating that virtual infrastructure is a high-value target.
  • Organizations failing to patch vulnerabilities risk data breaches, financial losses, and operational disruptions.

Immediate Action is Crucial

  • Patch Now: With no available workarounds, VMware users must immediately update their systems.
  • Restrict Privileged Access: Limit administrative rights on virtual machines to reduce attack vectors.
  • Monitor for Unusual Activity: Implement threat detection solutions to identify potential exploitation attempts.
  • Network Segmentation: Isolate critical virtual environments to prevent lateral movement in case of a breach.

Fact Checker Results

  • Exploitation Confirmed: The vulnerabilities are actively exploited, as reported by Microsoft Threat Intelligence Center.
  • No Workarounds Available: VMware has explicitly stated that patching is the only remediation option.
  • Rising Cyber Threats: Previous attacks on Ivanti and VMware products confirm an ongoing trend of targeting enterprise software vulnerabilities.

References:

Reported By: https://www.infosecurity-magazine.com/news/vmware-patch-exploited-zero-day/
Extra Source Hub:
https://www.medium.com
Wikipedia: https://www.wikipedia.org
Undercode AI

Image Source:

OpenAI: https://craiyon.com
Undercode AI DI v2Featured Image

Explore More: