[HIGH PRIORITY] VMware ESXi TOCTOU Privilege Escalation (CVE-2025-22224)

⚠ HIGH PRIORITY — CISA KEV. CVE-2025-22224 is a time-of-check time-of-use (TOCTOU) vulnerability in VMware ESXi VMX process allowing local attackers with VM access to escalate to code execution on the hypervisor host — critical for multi-tenant and cloud ESXi clusters.

Affected ESXi

• ESXi 8.0 before ESXi 8.0 U3d
• ESXi 7.0 before ESXi 7.0 U3s
• Hosts running untrusted or compromised VMs

Verify version

ssh root@esxi-host
esxcli system version get
vmware -v

Patching Method

1. Snapshot VM inventory; plan rolling cluster maintenance.
2. Download fixed ESXi image (8.0 U3d / 7.0 U3s) from Broadcom portal.
3. Evacuate VMs or enter maintenance mode per host.
4. Apply update via vSphere Lifecycle Manager or esxcli software profile.
5. Reboot host; verify esxcli system version get shows patched build.
6. Review VM guest tools for escape indicators on sensitive VMs.

esxcli system maintenanceMode set --enable true
esxcli software profile update -p ESXi-8.0.0-XXXX -d https://host/update
esxcli system maintenanceMode set --enable false

Workaround until patched

• Do not run untrusted VMs on shared ESXi hosts
• Enable lockdown mode and restrict host admin access
• Segment management network from VM traffic