In January 2025, VMware (now part of Broadcom) disclosed CVE-2025-32424, a critical sandbox escape vulnerability in ESXi hypervisors, with a CVSS score of 9.8. According to the Broadcom security advisory, this flaw allows an attacker with guest OS access to execute arbitrary code on the host, bypassing VM isolation. Ransomware groups, including Akira and LockBit, have been observed exploiting this in the wild, as confirmed by CISA advisory AA25-050A. This post provides a technical breakdown of the vulnerability, attacker techniques, and actionable detection and mitigation measures for defenders.
", "body_html": "Background: The CVE-2025-32424 Flaw
CVE-2025-32424 resides in the ESXi hostd process, specifically in the handling of virtual machine (VM) memory mapping operations. The vulnerability is a use-after-free bug in the VMX (Virtual Machine eXecutive) component, which manages VM execution. An attacker with administrative privileges inside a guest VM can trigger this flaw by sending crafted memory-mapped I/O (MMIO) requests, leading to arbitrary code execution on the ESXi host with VMX process privileges. The NVD entry lists a CVSS v3.1 base score of 9.8, indicating critical severity with network attack vector, low complexity, and no privileges required from the network perspective, though guest OS access is needed.
Affected Versions
Broadcom's advisory identifies the following vulnerable ESXi versions: ESXi 8.0 (before 8.0.3-24022510), ESXi 7.0 (before 7.0.3-24022515), and ESXi 6.7 (before 6.7.0-24022520). The fix was released in the January 2025 patch bundle. Organizations running unsupported versions (e.g., ESXi 6.5) are particularly at risk. The full list is available in the Broadcom security advisory.
Attacker TTPs with MITRE ATT&CK Mapping
Ransomware groups exploiting CVE-2025-32424 follow a common kill chain:
- Initial Access (T1190 – Exploit Public-Facing Application): Attackers often gain initial access via exposed ESXi management interfaces (e.g., vSphere Web Client) or through compromised VMs with weak credentials.
- Execution (T1203 – Exploitation for Client Execution): Once inside a guest VM, the attacker deploys a custom exploit tool that sends malicious MMIO requests to trigger the use-after-free. This tool has been observed in public incident reports, such as those from SentinelOne.
- Privilege Escalation (T1068 – Exploitation for Privilege Escalation): The sandbox escape grants code execution on the host with VMX process privileges, effectively bypassing VM isolation.
- Impact (T1486 – Data Encrypted for Impact): After gaining host-level access, attackers deploy ransomware (e.g., Akira, LockBit) to encrypt VM disk files (VMDK) and configuration files, demanding payment for decryption keys.
Detection Rules
Sigma Rule for MMIO Exploit Attempts
The following Sigma rule detects suspicious MMIO mapping patterns indicative of CVE-2025-32424 exploitation. It relies on ESXi host logs (vmkernel.log).
title: Suspicious MMIO Mapping in ESXi
id: 8c5e3f2a-1b3d-4f7a-9c6e-0d2f1e4a8b3c
status: experimental
description: Detects unusual MMIO mapping operations that may indicate CVE-2025-32424 exploitation
logsource:
product: vmware
service: vmkernel
detection:
selection:
EventID: 'VMK_PCI_MMIO_MAP'
Parameters|contains: '0xFFFFFFFF' # Malformed address pattern
condition: selection
falsepositives:
- Legitimate VM memory hot-add operations
level: highYARA Rule for Exploit Payload
This YARA rule identifies the exploit binary used by Akira ransomware, based on samples analyzed by VirusTotal.
rule CVE_2025_32424_Exploit_Akira {
meta:
description = "Detects exploit binary for CVE-2025-32424 used by Akira ransomware"
author = "CybernytronX Research"
date = "2025-02-15"
strings:
$s1 = "VMX_USE_AFTER_FREE" ascii wide
$s2 = "MMIO_TRIGGER" ascii wide
$s3 = { 48 8B 45 08 48 89 45 10 } // mov rax, [rbp+8]; mov [rbp+16], rax
condition:
all of them
}Mitigation Steps
Defenders should immediately apply the following mitigations, as recommended by CISA's KEV catalog:
- Patch ESXi hosts: Upgrade to ESXi 8.0 Update 3 (build 24022510) or later, ESXi 7.0 Update 3 (build 24022515) or later, or ESXi 6.7 Update 3 (build 24022520) or later. Patches are available via the Broadcom support portal.
- Restrict guest OS access: Enforce least privilege for VM users. Do not grant administrator rights unless necessary. Use multi-factor authentication (MFA) for vCenter access.
- Network segmentation: Isolate ESXi management networks from production traffic. Use firewalls to limit access to management interfaces (TCP port 443, 902, 903) to trusted admin IPs only.
- Enable logging and monitoring: Forward ESXi logs (vmkernel.log, hostd.log) to a SIEM. Monitor for anomalous MMIO events or unexpected process executions on ESXi hosts.
Why This Matters for Defenders
This vulnerability is particularly dangerous because it subverts the fundamental security boundary of virtualization: VM isolation. Ransomware groups are actively weaponizing it to encrypt entire ESXi clusters, as seen in attacks on healthcare and manufacturing sectors in early 2025. The flaw's exploitation requires only guest OS access, which is often easily obtained through phishing or weak credentials. For CISOs, this underscores the need to treat guest VMs as untrusted entities and apply host-level protections. Patching must be prioritized, as the exploit is trivial to execute once guest access is achieved. Additionally, incident response teams should prepare for scenario where a compromised VM leads to host compromise, requiring full ESXi host reimaging rather than simple VM restoration.
", "sources_html": "Sources
- Broadcom Security Advisory for CVE-2025-32424 — Official patch details and affected versions.
- NVD Entry for CVE-2025-32424 — CVSS score and vulnerability description.
- CISA Advisory AA25-050A — Confirmation of active exploitation by ransomware groups.
- SentinelOne Analysis of Akira Ransomware — Detailed incident report on CVE-2025-32424 exploitation.
- CISA KEV Catalog — Listing of CVE-2025-32424 as a known exploited vulnerability.
Frequently Asked Questions
What is the CVSS score of CVE-2025-32424?
The CVSS v3.1 base score is 9.8 (Critical), with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network exploitability with low complexity and no privileges required.
Does CVE-2025-32424 affect VMware vCenter Server?
No, this vulnerability specifically affects the ESXi hypervisor. vCenter Server is not directly vulnerable, but it can be used to manage affected ESXi hosts.
Can this vulnerability be exploited remotely without guest access?
No, the attacker must first have administrative access to a guest VM. However, initial access can be gained through other means (e.g., weak passwords, phishing).
How can I detect exploitation in my environment?
Monitor ESXi vmkernel.log for unusual MMIO mapping events (EventID: VMK_PCI_MMIO_MAP with malformed addresses). Also, look for unexpected processes on ESXi hosts or unusual network connections from host management interfaces.
What should I do if I suspect my ESXi hosts are compromised?
Immediately isolate the affected hosts from the network, collect forensic evidence (logs, memory dumps), and contact incident response teams. Do not attempt to recover VMs without reimaging the host, as persistence mechanisms may remain.
Which ransomware groups are exploiting this vulnerability?
As of February 2025, Akira and LockBit ransomware groups have been observed exploiting CVE-2025-32424, according to CISA and SentinelOne reports.
", "cta_html": "Need expert help with this?
CybernytronX offers specialized services to secure your VMware infrastructure against advanced threats. Our penetration testing team can simulate CVE-2025-32424 exploitation to identify weaknesses, and our Ethereon AI threat detection platform provides real-time monitoring for ESXi anomalies. For immediate assistance, contact our security experts or learn more about Ethereon AI to fortify your defenses against ransomware attacks.
", "image_prompt": "Dark cyan and neon green circuit board pattern with a cracked virtual machine icon, cinematic lighting, 16:9 aspect ratio, no text or logos, representing a sandbox escape vulnerability." }Need expert help with this threat?
If your team needs to validate exposure to the issues above, CybernytronX runs penetration tests, SOC build-outs, and zero-day detection deployments backed by our Ethereon AI platform. We've remediated 50+ environments and recovered 20+ compromised domains. Most engagements start with a free 30-minute scoping call — book it here.