Over 37,000 VMware ESXi servers vulnerable to ongoing attacks

Over 37,000 VMware ESXi servers vulnerable to ongoing attacks
Summary: Over 37,000 VMware ESXi instances are at risk due to the critical out-of-bounds write vulnerability CVE-2025-22224, which is being actively exploited. Following a report from The Shadowserver Foundation, it was noted that around 4,500 devices were patched recently, but many remain unprotected. The U.S. Cybersecurity & Infrastructure Security Agency (CISA) has set a deadline of March 25, 2025, for federal agencies to apply necessary updates.

Affected: VMware ESXi

Keypoints :

  • Officially noted vulnerabilities also include CVE-2025-22225 and CVE-2025-22226.
  • Critical-severity VCMI heap overflow vulnerability allows local attackers to execute code on the host.
  • The majority of vulnerable instances are located in China, France, and the United States.
  • Broadcom has published a FAQ page providing further information and action recommendations.
  • No workarounds are available; users are advised to update or cease using the affected product.

Source: https://www.bleepingcomputer.com/news/security/over-37-000-vmware-esxi-servers-vulnerable-to-ongoing-attacks/

Views: 12