CISA Alerts on Ransomware Threats

On February 5, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) flagged a serious security issue. Ransomware groups are exploiting a flaw known as CVE-2025-22225 in VMware ESXi. This vulnerability is now listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog. It’s crucial for businesses using VMware ESXi to be aware of this development and act swiftly to protect their systems.

Understanding the Exploit Kit

The vulnerability CVE-2025-22225 isn’t alone. It sits beside two others identified by Broadcom in early March 2025: CVE-2025-22224, a heap overflow issue, and CVE-2025-22226, an information disclosure threat. In January 2026, Huntress researchers detected a cyber toolkit exploiting all three flaws. This toolkit reportedly uses techniques for information leakage and memory corruption. It may even have been developed by Chinese-speaking developers before VMware issued a public warning in 2024.

Navigating Vulnerability Updates

Currently, the KEV catalog only marks CVE-2025-22225 as known to be used in ransomware attacks, leaving the other vulnerabilities with an “Unknown” status. This lack of clarity presents challenges for security teams needing to prioritize their updates. Experts such as Glenn Thorpe suggest using an RSS feed to track updates from the KEV catalog to help manage emerging threats promptly.

For more cybersecurity insights and updates, subscribe to our newsletters. Stay informed with daily, weekly, and breaking news tailored just for you.

Ready to take data security seriously?

Discover how Qsentinel can protect your organization against ransomware, enforce true data sovereignty, and stay ahead of the quantum threat. Their purpose-built workspace is designed for exactly that.

👉 Check out Qsentinel now and secure your future.