Thousands of VMware ESXi Servers Exposed: Critical Zero-Day Threat Looms

At a glance:

• Critical vulnerability: More than 37,000 VMware ESXi servers worldwide were still exposed to an actively exploited flaw, CVE-2025-22224, days after VMware patched it.
• Immediate risk: Attackers who already control a virtual machine can break out and run code on the host.
• Global impact: Europe had about 12,600 of the exposed servers, with large counts in China, France and the U.S.
• VMware response: Broadcom’s VMware released patches on March 4, 2025.
• Expert insights: Admins are urged to patch now, since the flaw was used as a zero-day.

A VM escape bug under active attack

On March 4, 2025, Broadcom’s VMware disclosed three ESXi flaws that attackers had already exploited as zero-days. The most serious, CVE-2025-22224, lets someone with administrator rights inside a virtual machine escape it and run code in the host’s VMX process. Shadowserver Foundation scans days later still found more than 37,000 internet-exposed ESXi instances that were vulnerable.

ESXi runs the virtual machines behind many corporate data centers and private clouds, so one compromised host can expose every VM on it. That makes ESXi a favorite target for ransomware gangs. They encrypt the hypervisor itself.

Where the exposed servers are

The exposed servers are spread around the world. Shadowserver’s count fell from about 41,500 on March 4 to around 37,000 a few days later. Patching was happening. Slowly.

Reporting on the Shadowserver data put about 12,600 of the vulnerable servers in Europe, with France alone accounting for more than 4,000. China and the U.S. also had thousands each.

Patches are out

VMware released fixed ESXi builds alongside its March 4 advisory, VMSA-2025-0004. The patches are the fix. There are no workarounds.

VMware’s advisory also covers two related flaws that attackers chained with the VM escape, and CISA added all three to its Known Exploited Vulnerabilities catalog. Admins should check every ESXi host against the advisory’s fixed versions.

What admins should do now

Patch first. Because the bug starts from inside a VM, an attacker needs a foothold in a guest first, which is common after phishing or a compromised web app.

After patching, review who has administrator access to guest VMs and limit management interfaces to trusted networks. A hypervisor that can be reached from the internet should not be.

The bigger lesson

Tens of thousands of hosts stayed exposed days after a patch for an actively exploited bug. Hypervisors are often patched less often than ordinary servers because updates mean downtime for every VM they host.

That habit is what attackers count on, and planning maintenance windows for ESXi updates before the next emergency is the fix.

Check the build numbers. Patch today.

Frank Jones, CISSP

Frank Jones has loved computers from the age of 13. Frank got his hacking career started when he downloaded a war dialing program that he used to detect dial up modems in his hometown of Chicago. Frank Jones now works as a JAVA coder and cyber security researcher.