VulnTideExploited vulnerabilities, by vendor. Data as of 28 Oct 2026.
Known exploitedIn CISA's KEV catalog since 4 March 2025Ransomware use: unknown
VMware ESXi and Workstation

CVE-2025-22224: VMware ESXi and Workstation TOCTOU Race Condition Vulnerability

Is it exploited?

Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 4 Mar 2025, the same day the CVE record was published.

How likely is exploitation in the next 30 days?
1.6%

EPSS score, percentile 75.1 of all scored records

How severe?
9.3 Critical

CVSS v3.1 base score, given by the CNA

What should I do?

Required action (CISA), due 25 Mar 2025: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

The CVE record links no vendor advisory, patch or mitigation.

Which versions are affected?

Affected: 8.0 up to, not including, ESXi80U3d-24585383; 8.0 up to, not including, ESXi80U2d-24585300; 7.0 up to, not including, ESXi70U3s-24585291; 17.x up to, not including, 17.6.3; 5.x, 4.5.x; 5.x, 4.x, 3.x, 2.x; 3.x, 2.x

Versions by product

Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.

What to do

Required action, set by CISA

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA due date for this action: 25 March 2025.

Advisories and patches

The CVE record links no vendor advisory, patch or mitigation.

Linked from CISA's catalog entry

Affected products and versions

As listed in the CVE record.

VMware ESXi
StatusVersions
Affected8.0 up to, not including, ESXi80U3d-24585383
Affected8.0 up to, not including, ESXi80U2d-24585300
Affected7.0 up to, not including, ESXi70U3s-24585291

Versions not listed are: unaffected.

VMware Workstation
StatusVersions
Affected17.x up to, not including, 17.6.3

Versions not listed are: unaffected.

VMware VMware Cloud Foundation
StatusVersions
Affected5.x, 4.5.x

Versions not listed are: unaffected.

VMware Telco Cloud Platform
StatusVersions
Affected5.x, 4.x, 3.x, 2.x

Versions not listed are: unaffected.

VMware Telco Cloud Infrastructure
StatusVersions
Affected3.x, 2.x

Versions not listed are: unaffected.

Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.

About this vulnerability

VMware ESXi and Workstation contain a time-of-check time-of-use (TOCTOU) race condition vulnerability that leads to an out-of-bounds write. Successful exploitation enables an attacker with local administrative privileges on a virtual machine to execute code as the virtual machine's VMX process running on the host.

Summary: CISA's KEV catalog, as of 28 Oct 2026.

  • CISA added CVE-2025-22224 to its Known Exploited Vulnerabilities (KEV) catalog on 4 Mar 2025.
  • CISA's ransomware flag for this entry is "Unknown": no evidence of ransomware use in the catalog, which is not proof of none.
  • The due date CISA sets for the required action is 25 Mar 2025.
  • The CVE record was published on 4 Mar 2025, the same day it was added to KEV.
  • The CVE record carries a CVSS v3.1 base score of 9.3 (Critical), given by its CNA.
  • FIRST's EPSS model puts the probability of exploitation in the next 30 days at 1.6% (percentile 75.1), as of 28 Oct 2026.
  • CISA's SSVC assessment in the CVE record: exploitation active, automatable no, technical impact total.

Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026. About the data.

Description

VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.

Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.

Weakness

  • CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition

CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record and the KEV entry.

Timeline

DateEvent
4 Mar 2025CVE record published
4 Mar 2025Added to CISA KEV
25 Mar 2025CISA due date for the required action
26 Feb 2026CVE record last updated

References

More exploited VMware vulnerabilities

  • CVE-2025-22225: VMware ESXi Arbitrary Write Vulnerability (added 4 Mar 2025)
  • CVE-2025-22226: VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability (added 4 Mar 2025)
  • CVE-2024-38812: VMware vCenter Server Heap-Based Buffer Overflow Vulnerability (added 20 Nov 2024)
  • CVE-2024-38813: VMware vCenter Server Privilege Escalation Vulnerability (added 20 Nov 2024)
  • CVE-2024-37085: VMware ESXi Authentication Bypass Vulnerability (added 30 Jul 2024)
  • CVE-2022-22948: VMware vCenter Server Incorrect Default File Permissions Vulnerability (added 17 Jul 2024)