Archive — US — techcrunch
Broadcom urges VMware customers to patch ‘emergency’ zero-day bugs under activeexploitation
Broadcom alerts VMware users to urgently patch three zero-day vulnerabilities (CVE-2025-22224, CVE-2025-22225, CVE-2025-22226) in ESXi, Workstation, and Fusion, which are actively exploited by hackers. Failure to address these could lead to unauthorized access to multiple virtual machines. Officials emphasize the need for immediate action, citing the danger posed by ransomware groups targeting these vulnerabilities.
Key points
- Broadcom acquired VMware in 2023 and identifies three critical vulnerabilities being actively exploited.
- Vulnerabilities allow attackers with admin access to escape virtual machine protections and access the hypervisor.
- Exploitation could lead to widespread unauthorized access to multiple virtual machines across organizations.
- Microsoft discovered these vulnerabilities and notified Broadcom, highlighting the threat posed by ransomware groups.
- Broadcom released emergency patches and urged users to act quickly, while CISA warned federal agencies to secure their systems.
Why it matters
- The vulnerabilities fit into a larger context of increased targeting of virtualization technologies by ransomware gangs.
- The cybersecurity landscape has seen similar attacks in the past, such as the ESXIArgs campaign exploiting older VMware flaws.
- By 2025, the threat landscape continually evolves, raising concerns over corporate cybersecurity and reliance on virtual infrastructures.
Broadcom's urgent warning and the swift release of patches for these critical vulnerabilities underscore the pressing cybersecurity challenges organizations face amid evolving threats from ransomware groups.