Broadcom has discovered three vulnerabilities in VMware Esxi, Workstation and Fusion, discovered by Microsoft’s Threat Intelligence Center. The defects, which were used in the real world attacks at the time of the discovery, may allow attackers with administrator or root access to a virtual machine to violate the underlying hypervisor, which may expose all connected VMs and sensitive data.

How do these vulnerabilities work?

If a threat actor gets administrative access to the guest operating system from a virtual machine, they can increase privileges and break into the hypervisor. Once they were inside, they could manipulate other virtual machines or have access to the same hypervisor, which poses a significant security risk.

The three vulnerabilities are:

• CVE-2025-22224: A time-or-check-time consumption in VMware ESXI and Workstation, which can lead to an out-of-or soil writing as an attacker already has admin privileges.
• Cve-2025-22225: An arbitrary writing pleasure in VMware ESXI.
• CVE-2025-22226: A vulnerability to information on information in VMware ESXI, Workstation and Fusion that can be used to leak memory.

In order to correct the vulnerabilities, customers must apply the patches found in Broadcom’s notice. All versions of VMware ESX, VMware VSphere, VMware Cloud Foundation or VMware Telco Cloud platform are affected, except those with the latest update.

See: Google Chrome’s switch to Manifest V3 Keep breaking ads like UBLOCK origin.

What products are affected?

The following products are influenced by all three Cves (via fast7)::

• Broadcom VMware ESXI 7.0 and 8.0.
• Broadcom VMware Cloud Foundation 4.5.x and 5.x.
• Broadcom VMware Telco Cloud Platform 5.x, 4.x, 3.x, and 2.x.
• Broadcom VMware Telco Cloud Infrastructure 3.x and 2.x.

The following product is vulnerable to CVE-2025-22224 and CVE-2025-2222 specifically:

• Broadcom VMware Workstation 17.x.

The following product is vulnerable to CVE-2025-2226 specifically:

• Broadcom VMware Fusion 13.x.

Vmware’s live patch feature will not automatically apply the patches in this case.

VMware Cloud Foundation operations, automation, aria suite and VMware NSX are not affected.

Last year, VMware ESXI servers were hit by a double outfit ransomware variant, with the threat actors personifying a real organization.