Critical VMware ESXi Vulnerability Exploited by Ransomware

On February 4, 2026, a crucial alert was raised by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) about ransomware groups exploiting a significant vulnerability in VMware ESXi. This vulnerability, known as CVE-2025-22225, enables attackers to escape virtual sandbox environments. Astonishingly, these zero-day attacks have been traced back to early 2024.

Broadcom addressed this issue in March 2025, patching it alongside a memory leak (CVE-2025-22226) and a temporal logic flaw (CVE-2025-22224). Despite these efforts, risks remain high due to ongoing exploitation. The vulnerability allows unauthorized users with VMX process privileges to perform arbitrary kernel writes, escaping the virtual machine’s security confinements.

Urgent Action Required for Organizations

CISA has incorporated CVE-2025-22225 into its Known Exploited Vulnerabilities catalog. Organizations must urgently address this flaw to protect against ransomware threats. CISA’s Binding Operational Directive (BOD) 22-01 emphasizes this necessity, urging adherence to vendor mitigation strategies or cessation of the use of affected products if mitigations are unavailable.

Given VMware’s widespread use in managing sensitive corporate data, the focus on these vulnerabilities is essential. Previously, a severe flaw (CVE-2025-41244) in VMware Aria Operations was similarly patched following exploitations. Additionally, recent attention to a critical VMware vulnerability (CVE-2024-37079) necessitates prompt action from federal entities.

As history shows, these threats are not isolated. GreyNoise reported 59 hidden security flaws related to ransomware campaigns last year. Organizations utilizing VMware must stay alert and ensure system updates to mitigate these escalating risks.

Stay informed, update systems, and safeguard your digital infrastructure from evolving cyber threats.

For more insights and tips on cybersecurity, consider subscribing to our newsletter.

Ready to take data security seriously?

Discover how Qsentinel can protect your organization against ransomware, enforce true data sovereignty, and stay ahead of the quantum threat. Their purpose-built workspace is designed for exactly that.

👉 Check out Qsentinel now and secure your future.