Security readout for executives and security teams
Plain-English summary
This flaw can let an attacker who already has elevated control within an ESXi VMX process break out of its sandbox and write to the host kernel. That could compromise the confidentiality, integrity, and availability of virtualized workloads. CISA lists the vulnerability as known exploited, making prompt investigation and remediation important.
Executive priority
Treat this as an immediate remediation priority because exploitation is documented by CISA and successful abuse could cross a virtualization boundary into the ESXi kernel. Ask infrastructure owners to establish exact build exposure, follow Broadcom guidance, and report remediation coverage. Avoid assuming every listed product family or version is vulnerable without validating the vendor matrix.
Technical view
CVE-2025-22225 is a CWE-123 arbitrary-write vulnerability in VMware ESXi. With privileges inside the VMX process, an attacker may perform an arbitrary kernel write and escape the sandbox. CVSS 3.1 rates it 8.2: local access, low complexity, high privileges, no user interaction, changed scope, and high security impact.
Likely exposure
Investigate ESXi 7.0 and 8.0 deployments and the listed VMware Cloud Foundation, Telco Cloud Platform, and Telco Cloud Infrastructure families. The supplied version data is internally ambiguous and does not identify exact vulnerable builds. Successful exploitation requires prior privileges within the VMX process, so exposure is not equivalent to unauthenticated remote compromise.
Exploitation context
CISA's Known Exploited Vulnerabilities listing supports active exploitation in the wild. The bundle does not describe attack frequency, targets, indicators, or whether exploitation occurs independently or as part of a vulnerability chain. The required VMX-process privileges indicate an attacker must first obtain a significant foothold or capability.
Researcher notes
The primitive is an arbitrary kernel write from a privileged VMX-process context, enabling sandbox escape. The source bundle supplies no root-cause detail, proof of concept, detection indicators, exploit-chain information, or precise fixed-build matrix. Researchers should avoid inferring direct remote reachability from the local attack vector and should consult Broadcom's advisory for authoritative version applicability.
Mitigation direction
- Check Broadcom's advisory for the exact affected and fixed builds applicable to every ESXi deployment.
- Apply Broadcom-supported updates or mitigations; exact patched versions are not included in this source bundle.
- Prioritize hosts running untrusted or less-trusted workloads because exploitation requires access within the VMX process.
- Restrict unnecessary administrative access to virtual machines and hypervisor management while remediation remains incomplete.
Validation and detection
- Inventory ESXi product versions and build numbers across standalone and integrated VMware platforms.
- Compare every running build against Broadcom's current affected and fixed-version matrix.
- Confirm remediated hosts are running a Broadcom-listed fixed build.
- Check Broadcom and CISA guidance for detection indicators; none are provided in this bundle.
- Investigate relevant host alerts or anomalies using approved incident-response procedures.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-123: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-22225 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.2 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H1.56vmwareVulnerability scoring details
Base CVSS 3.1 score
8.2HighVector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- Added to KEVCISA-ADP
CISA Known Exploited Vulnerabilities metadata lists this CVE as known exploited.
- ADP timelineCISA-ADP
CVE-2025-22225 added to CISA KEV
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2025-03-04T00:00:00.000Z: CVE-2025-22225 added to CISA KEV
Source materials
- CVE List V5 sourceCVE List V5
- https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25390CVE reference, vmware
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-22225CVE reference, CISA-ADP · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Write-what-where Condition
Write-what-where Condition represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.