Summary: Over 37,000 VMware ESXi instances are at risk due to the critical out-of-bounds write vulnerability CVE-2025-22224, which is being actively exploited. Following a report from The Shadowserver Foundation, it was noted that around 4,500 devices were patched recently, but many remain unprotected. The U.S. Cybersecurity & Infrastructure Security Agency (CISA) has set a deadline of March 25, 2025, for federal agencies to apply necessary updates.
Affected: VMware ESXi
Keypoints :
- Officially noted vulnerabilities also include CVE-2025-22225 and CVE-2025-22226.
- Critical-severity VCMI heap overflow vulnerability allows local attackers to execute code on the host.
- The majority of vulnerable instances are located in China, France, and the United States.
- Broadcom has published a FAQ page providing further information and action recommendations.
- No workarounds are available; users are advised to update or cease using the affected product.
Views: 12