CVE-2025-22224Vulnerability
VMware ESXi and Workstation TOCTOU Race Condition Vulnerability
Exploited in the wildCISA added it to its Known Exploited Vulnerabilities list on .
Reported by 1 independent source · first reported by Huntress · last reported
Last reported 9 months ago
CISA KEVAdded 4 Mar 2025
Fix due 25 Mar 2025
Used by ransomware: not knownCISA KEV catalogue
Fix due 25 Mar 2025
Used by ransomware: not knownCISA KEV catalogue
EPSS1.6%
higher than 75% of CVEsFIRST EPSS, as of 23 Oct 2026
higher than 75% of CVEsFIRST EPSS, as of 23 Oct 2026
What the reports say
1 report, newest first · the exact sentence from each-
ESXi Exploitation in the Wild“CVE-2025-22224 (CVSS 9.3): A TOCTOU vulnerability in VMCI leading to an out-of-bounds write, allowing code execution as the VMX process”
Indicators reported together
named in the same reports- inetd[.]pidin 1 report
- hxxps://github[.]com/RussianPanda95/Yara-Rules/blob/main/ESXiExploitToolkit/win_mal_GetShellPlugin.yarin 1 report
- hxxps://github[.]com/RussianPanda95/Yara-Rules/blob/main/ESXiExploitToolkit/win_mal_MAESTRO.yarin 1 report
- hxxps://github[.]com/RussianPanda95/Yara-Rules/blob/main/ESXiExploitToolkit/linux_mal_VSOCKpuppet.yarin 1 report
- hxxps://github[.]com/RussianPanda95/Yara-Rules/blob/main/ESXiExploitToolkit/win_mal_MyDriverSYS.yarin 1 report
- hxxps://github[.]com/huntresslabs/threat-intel/blob/main/2026/2026-01/vm_escape/sigma/proc_creation_win_devcon_disable_vmci_driver.ymlin 1 report
- hxxps://github[.]com/huntresslabs/threat-intel/blob/main/2026/2026-01/vm_escape/sigma/proc_creation_win_kdu_driver_tool_execution.ymlin 1 report
- 37972a232ac6d8c4…8d88956791a7in 1 report
- 4614346fc1ff74f0…a53c86dca25ein 1 report
- c3f8da7599468c11…0cf072469c89in 1 report
- dc5b8f7c6a8a6764…0027444d62bbin 1 report
- 2bc5d02774ac1778…6b68d2c0f94cin 1 report
Copy these 12 indicators · defanged
Also named with it: CVE-2025-22226, CVE-2025-22225
Thanks — we review every report.