Reupping this thread - remember to patch both #ESXicape and CVE-2025-22230 in VMware Tools.

The four vulns chained together allow full hypervisor escape from a Windows VM, without needing admin rights, gaining full SAN storage access to all VMs from one host - including to backups.

I understand technical exploitation details for this will start to emerge in public late next week, which will enable more groups to jump on the bandwagon. Currently limited to a ransomware group.

#threatintel

A new twist on #ESXicape - you need local admin rights to escape the VM to the hypervisor, right?

Slight issue - VMware Tools, installed inside VMs, allows local user to local admin privilege escalation on every VM due to vuln CVE-2025-22230

“A malicious actor with non-administrative privileges on a Windows guest VM may gain ability to perform certain high-privilege operations within that VM.”

Discovered by Positive Technologies, who US claim hack for Moscow.

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25518

Does anybody know anybody at VMware Security who could have a look at the #ESXicape knowledge base article please?

It's missing 6.5 and 6.7, which are definitely vulnerable and have patches available on Broadcom's site. They're also listed in the VMware Github advisory, but have been missed off the support site. It's causing people to not patch.

I wrote up everything I know about #ESXicape https://doublepulsar.com/use-one-virtual-machine-to-own-them-all-active-exploitation-of-esxicape-0091ccc5bdfc

#threatintel

Quick mspaint.exe diagram on this, calling it ESXicape

- Have access to something like a Windows 11 Virtual Desktop system in VMware, or a Linux box or some such?

- Use ESXicape, a chain of three zero days, to gain access to the ESXi Hypervisor.

- Use that to access every other VM, and be on the management network of VMware cluster

One you have this level of access, traditionally you'll see groups like ransomware actors steal files and wipe things. #ESXicape