vmware

Recent VMware Exploits: A Critical Look at 2024 and 2025 Vulnerabilities

By Ben Gebremeskel
| March 17, 2025

In the fast-paced world of cybersecurity, VMware has remained a prime target for attackers due to its widespread use in enterprise and cloud environments. Over the past year, multiple critical vulnerabilities have been discovered and actively exploited, underscoring the urgent need for organizations to adopt robust security practices.

This blog delves into the most significant VMware exploits from 2024 and 2025, shedding light on how attackers leveraged these weaknesses and how organizations can mitigate these threats.

March 2025: Active Exploitation of VMware ESXi Vulnerabilities

In March 2025, VMware disclosed that multiple vulnerabilities affecting VMware ESXi, Workstation, and Fusion were being actively exploited in the wild. The most notable flaws, CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226, allowed attackers with administrative privileges on a virtual machine to execute arbitrary code on the host system, potentially compromising the entire hypervisor.

This type of exploit, commonly known as an escape attack, is particularly dangerous as it enables attackers to move laterally across virtual environments. Security researchers at Microsoft Threat Intelligence Center were credited with discovering these vulnerabilities, and VMware quickly released patches to mitigate the risks.

Impact of the Exploit

Attackers could escape from a guest virtual machine (VM) and execute code on the host, allowing them to gain control of other VMs.
If exploited on a multi-tenant cloud environment, an attacker could compromise multiple customers’ workloads.
The vulnerability is being actively weaponized in ransomware attacks.

January 2025: VMware Aria Operations and Aria Automation Flaws

In early 2025, VMware identified multiple security flaws in VMware Aria Operations and Aria Automation, two essential tools for managing and automating virtualized infrastructure.

CVE-2025-22218 & CVE-2025-22222 (Aria Operations for Logs)
- These vulnerabilities allowed attackers with low-level access to extract sensitive credentials, potentially leading to lateral movement within an organization’s network.
CVE-2025-22215 (Aria Automation SSRF Vulnerability)
- This server-side request forgery (SSRF) flaw allowed attackers with “Organization Member” access to probe internal services running on the host or network.
- If exploited, attackers could gather intelligence about internal systems and use it for further attacks.

Why These Flaws Matter

Attackers could steal credentials to compromise integrated VMware products.
Lateral movement opportunities increase the risk of full system takeovers.
Exploits could facilitate multi-stage attacks, leading to data theft and ransomware deployment.

August 2024: BlackByte Ransomware Exploiting VMware ESXi Flaws

In mid-2024, BlackByte ransomware operators were observed exploiting CVE-2024-37085, an authentication bypass vulnerability in VMware ESXi. This flaw allowed attackers to gain administrative access by manipulating user groups on the hypervisor.

The Attack in Action

Threat actors created a group named “ESX Admins” and added unauthorized users to gain administrator privileges.
Attackers encrypted critical VMs, leading to significant downtime and financial losses.
Security researchers noted that the vulnerability was exploited within days of its public disclosure, demonstrating how quickly threat actors weaponize new exploits.

November 2024: Critical Vulnerabilities in VMware vCenter Server

As one of the most vital components in a VMware-based environment, vCenter Server has been an attractive target for cybercriminals. In November 2024, CVE-2024-38812 and CVE-2024-38813 were found to be actively exploited in the wild.

CVE-2024-38812 (Heap Overflow Vulnerability)
- Allowed remote attackers with network access to execute arbitrary code without authentication.
CVE-2024-38813 (Privilege Escalation)
- Enabled attackers to escalate privileges to root on affected systems.

These vulnerabilities put organizations at extreme risk, as vCenter Server manages VMware ESXi hosts and VMs. A successful compromise could mean full control over an enterprise’s virtual infrastructure.

How Organizations Can Mitigate These Risks

Given the critical nature of these exploits, VMware administrators must take immediate action to safeguard their environments. Here are some key security measures to mitigate these threats:

1. Apply Security Patches Immediately

Many of these vulnerabilities were exploited shortly after public disclosure, emphasizing the need for timely patching. Organizations should:

Subscribe to VMware Security Advisories and update software as soon as patches are released.
Automate patch management to reduce exposure time to known vulnerabilities.

2. Restrict Network Access to VMware Management Interfaces

Exploits often target vCenter Server, ESXi, and Aria Operations management consoles. To minimize risk:

Implement firewall rules to restrict access to VMware management interfaces.
Use VPN or zero-trust network access (ZTNA) for secure remote administration.

3. Implement Multi-Factor Authentication (MFA)

Enforce MFA for all administrative access to VMware environments.
Disable password-based authentication where possible in favor of SSH keys or certificate-based authentication.

4. Monitor for Suspicious Activity

Enable logging and monitoring for VMware infrastructure.
Use SIEM solutions to detect unusual access patterns.
Set up alerts for unauthorized changes to VMware admin groups (e.g., ESX Admins modifications).

5. Conduct Regular Security Assessments

Perform vulnerability scans and penetration testing on VMware infrastructure.
Audit user access controls to ensure least privilege principles are followed.
Implement network segmentation to prevent lateral movement in case of compromise.

Final Thoughts

VMware remains a critical component of modern IT infrastructures, but its widespread use also makes it a prime target for cyber threats. The exploits from 2024 and 2025 demonstrate the high stakes of failing to patch vulnerabilities quickly. Organizations that rely on VMware products must prioritize security by staying informed, proactive, and prepared.

By implementing rigorous patching strategies, enforcing security best practices, and continuously monitoring for emerging threats, businesses can fortify their virtual environments against the next wave of cyberattacks.

Is Your VMware Environment Secure?

If you’re unsure about your VMware security posture, consider conducting a comprehensive security assessment to identify and remediate potential vulnerabilities before attackers do.