InfoSecBulletin Cybersecurity for mankind
Broadcom issued a security alert on Tuesday, warning VMware customers about 3 exploited zero-day vulnerabilities. Vulnerabilities CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226 affect VMware ESXi, Workstation, and Fusion. Patches have been released for all affected products, but no workarounds are available.
CVE-2025-22224 is a critical VMCI heap overflow vulnerability in VMware ESXi and Workstation. It allows an attacker with local admin rights on a virtual machine to execute code as the VMX process on the host.
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
cPanel Flaw Lets Hosting Accounts With Mail Privileges Execute Code as Root
FortiSandbox, FortiOS, FortiProxy ZTNA flaws unveil, while Fortigate firewall actively exploited
CVE-2025-22225 is a high-severity vulnerability in VMware ESXi that enables an attacker with certain privileges in the VMX process to perform an arbitrary kernel write, potentially allowing them to escape the sandbox.
CVE-2025-22226 is a high-severity information disclosure vulnerability in VMware ESXi, Workstation, and Fusion. It results from an out-of-bounds read in the HGFS component, allowing an attacker with admin access to a VM to leak memory from the VMX process.
Broadcom, after acquiring VMware in 2023, noted that exploiting the vulnerabilities requires elevated privileges. This suggests they may have been used in targeted attacks after attackers gained initial access to the victim’s systems.
“This is a situation where an attacker who has already compromised a virtual machine’s guest OS and gained privileged access (administrator or root) could move into the hypervisor itself,” the vendor explained.
Broadcom acknowledges the Microsoft Threat Intelligence Center for reporting these vulnerabilities.
