VMware ESXi Authentication Bypass (CVE-2025-22226)

CVE-2025-22226 is an authentication bypass in VMware ESXi Host Client and API paths. Attackers with network access to ESXi management (port 443) may bypass login and execute privileged operations on hypervisors running Linux-based ESXi.

Affected ESXi

• ESXi 8.0 before ESXi 8.0 U3d
• ESXi 7.0 before ESXi 7.0 U3s
• Management interfaces exposed to LAN or internet

Verify build

ssh root@esxi-host
vmware -v
esxcli system version get

Patching Method

1. Snapshot inventory — export VM list and note maintenance window.
2. Download fixed image from VMware/Broadcom portal matching your ESXi major version (8.0 U3d or 7.0 U3s).
3. Put host in maintenance mode: esxcli system maintenanceMode set --enable true
4. Apply update via Lifecycle Manager, esxcli software profile update, or boot ISO upgrade per VMware KB.
5. Reboot host, exit maintenance mode, validate vmware -v shows patched build.
6. Rotate credentials — vCenter, ESXi root, and API tokens after patch.

# Quick version check after reboot
esxcli system version get | grep -E 'Version|Build'
esxcli network firewall get

Workaround until patched

• Restrict ESXi management VLAN; deny inbound 443 from internet
• Disable Host Client if not required; use vCenter only over VPN
• Audit ESXi logs for failed-then-success auth anomalies