CISA Flags VMware ESXi CVE-2025-22225 as Exploited in Ransomware Campaigns
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) updated its Known Exploited Vulnerabilities (KEV) catalog to indicate that CVE-2025-22225, a high-severity VMware ESXi VMX sandbox escape flaw, is now known to be used in ransomware campaigns. Broadcom patched the issue in March 2025 as part of advisory VMSA-2025-0004, describing CVE-2025-22225 as an arbitrary kernel write reachable by an attacker with privileges in the VMX process, enabling escape from the VMX sandbox to the ESXi kernel. The same advisory also addressed two other zero-days—CVE-2025-22224 (TOCTOU leading to out-of-bounds write/code execution as the VMX process) and CVE-2025-22226 (HGFS out-of-bounds read/memory disclosure)—which Broadcom previously tagged as actively exploited in the wild.
Reporting also tied the ESXi exploitation to earlier sophisticated activity: Huntress described Chinese-speaking threat actors leveraging access via a compromised SonicWall VPN to deliver tooling targeting VMware ESXi and chaining a VM escape technique that appeared to predate public disclosure of the March 2025 ESXi zero-days. Separately, GreyNoise research highlighted a broader KEV-catalog visibility gap, finding that CISA quietly “flipped” dozens of KEV entries during 2025 from “Unknown” to “Known” for ransomware use without prominent public notification—an approach that can materially affect enterprise prioritization when a vulnerability’s status changes to confirmed ransomware exploitation.
Timeline
Feb 4, 2026
GreyNoise reveals unpublicized KEV ransomware-flag changes
On February 4, 2026, Dark Reading reported GreyNoise research showing that CISA had made dozens of unannounced KEV ransomware-status updates during 2025. Thorpe also created an RSS feed to alert defenders when KEV ransomware flags change.
Feb 3, 2026
CISA updates KEV to confirm ransomware exploitation of CVE-2025-22225
On or around February 3, 2026, CISA updated the KEV entry for CVE-2025-22225 to show it is known to be used in ransomware campaigns. CISA did not disclose which ransomware groups or incidents were involved.
Jan 1, 2026
Huntress publicly reports details of the ESXi exploit toolkit
In January 2026, Huntress disclosed technical findings on an exploit toolkit that likely chained the three VMware ESXi flaws, including use of HGFS, VMCI, kernel-escape shellcode, and a VSOCK-based backdoor. The report linked the tooling to long-term activity by Chinese-speaking exploit developers.
Jul 1, 2025
BlueKeep KEV entry updated to show ransomware use
CISA updated the BlueKeep KEV entry in summer 2025 to indicate known ransomware exploitation, years after the vulnerability's original inclusion. The delayed change was cited by GreyNoise as an example of how KEV ransomware flags can lag real-world risk.
Mar 4, 2025
CISA adds CVE-2025-22225 to the KEV catalog
CISA added CVE-2025-22225 to its Known Exploited Vulnerabilities catalog on March 4, 2025. Under Binding Operational Directive 22-01, U.S. federal agencies were required to remediate the flaw by March 25, 2025.
Mar 1, 2025
Broadcom patches three VMware ESXi zero-days
In early March 2025, Broadcom released VMSA-2025-0004 to patch CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226 affecting VMware ESXi. The company said it had indications the flaws had been exploited in the wild as zero-days and warned they could be chained for VM escape and code execution.
Jan 1, 2025
CISA silently flips ransomware-use flags on dozens of KEV entries
During 2025, CISA updated multiple KEV entries to change the field indicating whether a vulnerability was known to be used in ransomware campaigns from "Unknown" to "Known" without public notice. GreyNoise researcher Glenn Thorpe later identified 59 such changes by diffing daily KEV snapshots.
Feb 1, 2024
Chinese-speaking attackers begin covert ESXi exploit-chain activity
Huntress assessed that Chinese-speaking threat actors were likely using a VMware ESXi exploit chain involving CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226 since at least February 2024. Reported activity included use of a compromised SonicWall VPN, an ESXi-focused toolkit, and related persistence and backdoor components.
See the full picture in Mallory
Mallory subscribers get deeper analysis on every story, including:
Who’s affected and how
Deep-dive technical analysis
Actionable next steps for your team
IPs, domains, hashes, and more
Ask questions and take action on every story
Filter by topic, classification, timeframe
Get matching stories delivered automatically
Related Entities
Vulnerabilities
Malware
Organizations
Sources
1 more from sources like dark reading
Related Stories
CISA Flags Actively Exploited VMware vCenter Server RCE (CVE-2024-37079)
**CISA added CVE-2024-37079, a critical VMware vCenter Server vulnerability, to its Known Exploited Vulnerabilities (KEV) Catalog after Broadcom indicated it has evidence of in-the-wild exploitation.** The flaw is a **9.8 CVSS** out-of-bounds write/heap-overflow issue in vCenter Server’s **DCERPC** implementation; an attacker with network access can send specially crafted packets that may result in **remote code execution (RCE)**. CISA’s KEV entry does not attribute exploitation to a specific threat actor and lists ransomware use as **unknown**, but the KEV addition triggers mandatory remediation timelines for US federal agencies. Reporting also noted CISA added multiple other enterprise software issues to KEV in a short span (including vulnerabilities affecting **Versa Concerto** and **Zimbra**, plus developer tools), but the vCenter Server item drew specific attention because it was **patched by Broadcom in 2024** and is still being exploited. Broadcom has not publicly provided details on the scope, victims, or exploitation chain beyond acknowledging observed exploitation, reinforcing the need for organizations running vCenter Server to validate exposure and ensure the relevant updates are deployed.
1 months ago
CISA KEV updates and active exploitation alerts highlight shifting vulnerability risk
CISA’s *Known Exploited Vulnerabilities (KEV) Catalog* continued to expand with newly confirmed in-the-wild exploitation, including the addition of **four CVEs**: `CVE-2019-19006` (Sangoma FreePBX improper authentication), `CVE-2021-39935` (GitLab CE/EE SSRF), `CVE-2025-40551` (SolarWinds Web Help Desk deserialization of untrusted data), and `CVE-2025-64328` (Sangoma FreePBX OS command injection). Under **BOD 22-01**, U.S. Federal Civilian Executive Branch agencies are required to remediate KEV-listed vulnerabilities by CISA’s due dates, and CISA urged non-federal organizations to use KEV as a prioritization input because these flaws are common initial access vectors. Separate reporting highlighted concerns about how CISA communicates changes to KEV metadata tied to ransomware risk: GreyNoise reported that across **59 instances in 2025**, CISA updated KEV entries to reflect **ransomware-associated exploitation** without proactively notifying defenders when the “known ransomware use” flag changed from *Unknown* to *Known*, which can materially affect patch prioritization. In parallel, third-party coverage described a CISA high-priority alert for a **critical KiloView Encoder Series** issue, `CVE-2026-1453` (CVSS **9.8**), caused by **missing authentication for critical functions** that could allow unauthenticated attackers to create/delete administrator accounts and gain full administrative control—posing disruption and lateral-movement risk in broadcast/production networks.
1 months ago
Active Exploitation of Critical RCE Vulnerabilities in Enterprise Infrastructure (Cisco UC and VMware vCenter)
Reports warn of **in-the-wild exploitation** of critical remote code execution vulnerabilities affecting widely deployed enterprise infrastructure. One report describes a purported Cisco Unified Communications zero-day, **CVE-2024-20253**, impacting *Cisco Unified Communications Manager (Unified CM)*, *Cisco Unity Connection*, and *Webex Calling Dedicated Instance*, and claims it enables **unauthenticated command execution** via the web management interface, creating risk of full system compromise and rapid opportunistic scanning of internet-exposed instances. Separately, **CISA added Broadcom VMware vCenter Server CVE-2024-37079** (CVSS 9.8) to the **Known Exploited Vulnerabilities (KEV)** catalog based on evidence of exploitation; the issue is described as a **DCE/RPC heap overflow** that can lead to RCE via specially crafted network packets, and Broadcom updated its advisory to acknowledge observed exploitation. A third item (Rapid7’s Metasploit wrap-up) is not about either of these active-exploitation advisories; it covers new Metasploit modules for unrelated vulnerabilities (e.g., Oracle E-Business Suite **CVE-2025-61882** and Splunk issues), which may increase general exploitation capability but does not substantively corroborate the Cisco or VMware events.
1 months ago