Target Industry
Indiscriminate, opportunistic targeting.
Overview
Three critical vulnerabilities have been identified in VMware products, specifically targeting ESXi, Workstation, and Fusion. These vulnerabilities, designated as CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226, expose significant security risks, including potential code execution, sandbox escape, and information disclosure. Key information:
- CVE-2025-22224 is identified as a Time-of-Check Time-of-Use (TOCTOU) vulnerability affecting VMware ESXi and Workstation. This flaw allows a local, authenticated attacker with administrative privileges to exploit the vulnerability, potentially leading to code execution within the virtual-machine executable (VMX) process. The exploitation of this vulnerability could enable the attacker to perform unauthorised actions, compromising the integrity and security of the virtualized environment.
- CVE-2025-22225 represents an arbitrary write vulnerability in VMware ESXi. This vulnerability can be exploited by a local, authenticated attacker with the necessary privileges to manipulate the VMX process, enabling them to escape the sandbox environment. Such an escape could grant the attacker access to the underlying hypervisor or host system, posing significant security risks including the potential for further attacks or data breaches.
- CVE-2025-22226 is an information-disclosure vulnerability affecting VMware ESXi, Workstation, and Fusion. An authenticated, local attacker with administrative privileges can exploit this vulnerability to cause the VMX process to leak sensitive contents from memory. This information disclosure can lead to the exposure of confidential data, potentially aiding further attacks or compromising the privacy and security of the virtualised systems.
These vulnerabilities highlight critical security gaps in VMware products, emphasising the need for immediate attention and remediation. Organisations utilising affected VMware products should promptly apply security patches provided by VMware.
Impact
The impact of the three identified vulnerabilities on VMware products, such as ESXi, Workstation, and Fusion is profound and far-reaching:
CVE-2025-22224: TOCTOU Vulnerability
- This Time-of-Check Time-of-Use (TOCTOU) vulnerability allows a local, authenticated attacker with administrative privileges to execute arbitrary code within the virtual-machine executable (VMX) process. The potential for unauthorised code execution could lead to various malicious activities, including the installation of malware, unauthorised data access, or disruption of services. This undermines the integrity and security of the virtualized environment, potentially allowing the attacker to manipulate or control virtual machines.
CVE-2025-22225: Arbitrary Write Vulnerability
- This vulnerability involves an arbitrary write flaw within VMware ESXi, enabling a local, authenticated attacker with the requisite privileges to manipulate the VMX process and escape the sandbox environment. The ability to escape the sandbox can lead to broader system compromise, granting the attacker access to the hypervisor or host system. This escalates the risk of further attacks, including privilege escalation, data breaches, and the potential to disrupt or control other virtual machines running on the same host.
CVE-2025-22226: Information Disclosure Vulnerability
- This information disclosure vulnerability affects VMware ESXi, Workstation, and Fusion. It allows an authenticated, local attacker with administrative privileges to exploit the VMX process to leak contents from memory. The leakage of sensitive information from memory can expose confidential data, such as encryption keys, passwords, and other critical information. This data exposure could facilitate further attacks, compromise the privacy of sensitive information, and lead to significant data breaches.
Vulnerability Detection
VMware has released updates to fix the vulnerabilities in their products. Here are the affected products and their fixed versions:
- VMware ESXi 8.0
- Vulnerabilities: CVE-2025-22224, CVE-2025-22225, CVE-2025-22226
- Fixed Versions: ESXi80U3d-24585383, ESXi80U2d-24585300
- VMware ESXi 7.0
- Vulnerabilities: CVE-2025-22224, CVE-2025-22225, CVE-2025-22226
- Fixed Version: ESXi70U3s-24585291
- VMware Workstation 17.x
- Vulnerabilities: CVE-2025-22224, CVE-2025-22226
- Fixed Version: 17.6.3
- VMware Fusion 13.x
- Vulnerability: CVE-2025-22226
- Fixed Version: 13.6.3
Users should update their VMware products to these fixed versions to protect against the vulnerabilities.
Exploitation
The detection of the exploit by the Microsoft Threat Intelligence Center indicates that sophisticated threat actors are targeting these vulnerabilities, increasing the urgency for organisations to patch and enhance their security measures. The vulnerability is actively being exploited in the wild and was added to the CISA Known Exploited Vulnerability list.
Containment, Mitigations & Remediation
To safeguard against potential attacks, organisations using the affected software are strongly encouraged to apply the latest patches to protect against potential threats.
Threat Landscape
Advanced Persistent Threat (APT) groups known for targeting virtualisation technologies have been leveraging these vulnerabilities to infiltrate high-value targets. These groups focus on sectors such as telecommunications, finance, and critical infrastructure, primarily in regions with advanced cloud and virtualisation deployments.
Threat Group
Several APT groups have been observed exploiting these vulnerabilities, notably APT28, APT29, and APT41:
- APT28, also known as Fancy Bear, is a Russian cyber-espionage group known for targeting government, military, and security organisations
- APT29, also called Cozy Bear, is another Russian group with a focus on high-profile espionage campaigns against government entities, research institutions, and companies involved in critical infrastructure
- APT41, a Chinese cyber-espionage and cyber-crime group, is known for its dual mission of conducting state-sponsored espionage while simultaneously engaging in financially motivated activities
These groups have a history of leveraging sophisticated techniques to exploit vulnerabilities in virtualisation technologies, aiming to gain persistent access, steal sensitive information, and disrupt operations across various high-value sectors. The involvement of these well-resourced and highly skilled adversaries underscores the urgency for organisations to strengthen their security postures and protect against these sophisticated threats.
Further Information
