Get the latest tech news
Broadcom urges VMware customers to patch ‘emergency’ zero-day bugs under active exploitation
Security experts warn of ‘huge impact’ of actively exploited hypervisor flaws that allow sandbox escape
The three vulnerabilities — collectively dubbed “ESXicape” by one security researcher — affect VMware ESXi, Workstation, and Fusion, which are widely-used software hypervisor products that allow multiple virtual machines to be managed on a single server. Broadcom, which acquired VMware in 2023, said that the vulnerabilities(tracked as CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226) could allow an attacker with administrator or root privileges on a virtual machine to escape its protected sandbox and gain broader unauthorized access to the underlying hypervisor product. VMware vulnerabilities are frequently targeted by ransomware groups due to their ability to be exploited to compromise multiple servers during a single attack, and given that sensitive corporate data is often stored in these virtualized environments.
Or read this on TechCrunch