Exploit for VMware Zero-Day Flaws Likely Built a Year Before Public Disclosure

Fresh attacks targeted three VMware ESXi vulnerabilities disclosed in March 2025 as zero-days, with an exploit toolkit reportedly built over a year prior to public disclosure. The bugs, tracked as CVE-2025-22224, CVE-2025-22225 and CVE-2025-22226, were patched in March 2025, and a December 2025 attack attempt was linked to this tooling by Huntress.

Initial access was gained via a compromised SonicWall VPN, after which a Domain Admin account was used to reach the primary domain controller and deploy the ESXi exploit toolkit, which then escaped the VM to implant a backdoor on the ESXi hypervisor. The analysis suggests the exploit was developed by a well-resourced threat actor likely operating in a Chinese-speaking region, with the toolkit potentially dated February 2024 and a VSOCK tool dating from November 2023.

Security researchers warn that the toolkit supports 155 ESXi builds across versions 5.1 through 8.0, leaving end-of-life deployments exposed with no fix available; as of 8 January 2026, over 30,000 internet-exposed ESXi instances could be vulnerable to CVE-2025-22224.