DaystoPatch

Broadcom (VMware)Exploited incident

VMware ESXi, Workstation and Fusion VM-escape zero-days (VMSA-2025-0004)

CVE-2025-22224, CVE-2025-22225, CVE-2025-22226Critical, CVSS 9.3In CISA's Known Exploited Vulnerabilities catalog since 4 Mar 2025

  • Exploited before a fix
  • Known ransomware use
FixedFixed for every supported version on the day it became public.
Embed this live clock

Response

Silence
same day
First public report to first vendor statement
Exposure
same day
First public report to first fix
Follow-through
same day
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    date only

    Broadcom VMSA-2025-0004 (Wayback snapshot 2025-03-04 11:52 UTC)CuratedQuote verified

    VMware by Broadcom has information to suggest that exploitation of CVE-2025-22224 has occurred in the wild.

    Exploitation of all three CVEs was disclosed in the advisory itself (Issue date 2025-03-04), which shipped with fixes. Reported by the Microsoft Threat Intelligence Center. No earlier public report found.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:b63737d271c42ff4…
    Used in metrics
    Yes
    Dispute this timestamp
    7 more sources for this moment
    CISA KEV (CVE-2025-22224)ClaimedQuote verified4 Mar 2025

    VMware ESXi and Workstation TOCTOU Race Condition Vulnerability

    Added to CISA's KEV catalog on 2025-03-04.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2025-22225)ClaimedQuote verified4 Mar 2025

    VMware ESXi Arbitrary Write Vulnerability

    Added to CISA's KEV catalog on 2025-03-04.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2025-22226)ClaimedQuote verified4 Mar 2025

    VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability

    Added to CISA's KEV catalog on 2025-03-04.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2025-22224ClaimedQuote verified4 Mar 2025, 11:56 UTC

    VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local administrative privileges on a virtual

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:3ddae712866719fc…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet4 Mar 2025, 12:17 UTC

    Broadcom patched VMware zero-days CVE-2025-22224, CVE-2025-22225 and CVE-2025-22226 after Microsoft warned it of exploitation.

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet4 Mar 2025, 13:00 UTC

    VMSA-2025-0004: # VMware ESXi, Workstation, and Fusion updates address multiple vulnerabilities (CVE-2025-22224, CVE-2025-22225, CVE-2025-22226) VMCI heap-overflow vulnerability (CVE-2025-22224): A malicious actor with local administrative privileges on a virtual machine

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Hacker NewsClaimedQuote not checked yet25 Apr 2026, 01:47 UTC

    last one was 8 years ago Not true. There's way more than that list. I could immediately think of 2 more from last year: CVE-2025-22224 and CVE-2025-22225

    Earliest third-party post we hold.

    Source
    Hacker News hn
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    date onlysame day

    Broadcom VMSA-2025-0004 (Wayback snapshot 2025-03-04)CuratedQuote verified

    2025-03-04 (Initial Advisory)

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:b63737d271c42ff4…
    Used in metrics
    Yes
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    date onlysame day

    Broadcom VMSA-2025-0004 (Wayback snapshot 2025-03-04)CuratedQuote verified

    Multiple vulnerabilities in VMware ESXi, Workstation, and Fusion were privately reported to VMware. Updates are available to remediate these vulnerabilities in affected VMware products.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:b63737d271c42ff4…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    date onlysame day

    Broadcom VMSA-2025-0004 (Wayback snapshot 2025-03-04)CuratedQuote verified

    To remediate CVE-2025-22225 apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' found below.

    Initial response matrix lists fixes for every supported line: ESXi 8.0 (ESXi80U3d-24585383, ESXi80U2d-24585300), ESXi 7.0 (ESXi70U3s-24585291), Workstation 17.6.3, Fusion 13.6.3, VCF 5.x/4.5.x via async patch (KB88287), Telco Cloud via KB389385. The change log shows no later fixed-version changes. End-of-general-support ESXi 6.x is not in the matrix.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:b63737d271c42ff4…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

VMware ESXi VM-escape flaws exploited as zero-days; patches since Mar 4, 2025

Attackers who already controlled a virtual machine used three VMware flaws to break out to the ESXi host; Broadcom disclosed the attacks and shipped patches on 4 March 2025.

In plain words

VMware ESXi is the software that runs most of our virtual servers. In March 2025 attackers were found using three flaws that let someone who has taken over one virtual machine break out and control the whole host and every machine on it, a technique ransomware groups favour. Broadcom released patches on 4 March 2025, the same day it announced the attacks. If our ESXi hosts are not on the patched builds, they need to be updated.

What happened and who is affected

What happened

On 4 March 2025 Broadcom published VMSA-2025-0004 for three flaws in VMware ESXi, Workstation and Fusion: a VMCI out-of-bounds write (CVE-2025-22224, 9.3), an ESXi arbitrary kernel write (CVE-2025-22225, 8.2) and an HGFS memory leak (CVE-2025-22226, 7.1). Together they let an attacker with administrator rights inside a guest VM escape to the hypervisor. Broadcom said it had information that all three had been exploited in the wild; they were reported by the Microsoft Threat Intelligence Center. CISA added them to the Known Exploited Vulnerabilities catalog the same day and lists known ransomware use for CVE-2025-22225.

Who is affected

VMware ESXi 8.0 before ESXi80U3d-24585383 / ESXi80U2d-24585300, ESXi 7.0 before ESXi70U3s-24585291, Workstation 17.x before 17.6.3, Fusion 13.x before 13.6.3 (CVE-2025-22226 only), VMware Cloud Foundation 4.5.x and 5.x, and Telco Cloud Platform/Infrastructure.

CVE-2025-22224, CVE-2025-22225, CVE-2025-22226. Reviewed 22 Oct 2026. https://daystopatch.com/incidents/broadcom-vmware-cve-2025-22224/

Affected products

  • VMware ESXi 7.0 and 8.0
  • VMware Workstation 17.x
  • VMware Fusion 13.x
  • VMware Cloud Foundation 4.5.x and 5.x
  • VMware Telco Cloud Platform / Infrastructure
How we built this timeline

Grouped: all three CVEs are in one advisory, were reported together by MSTIC, and each carries Broadcom's in-the-wild exploitation note; all were added to KEV on 4 Mar 2025 (ransomware use 'Known' for CVE-2025-22225). Primary CVE is CVE-2025-22224 (highest CVSS, listed first).

Exploitation disclosed in the same advisory that shipped fixes, so world = vendor = First fix. Broadcom's portal gives dates only.

The 17 Sep 2026 snapshot's change log still shows only the 4 Mar 2025 initial advisory.

Related

Broadcom (VMware) report card