CVE-2025-22225

Exploited in the Wild ✓ Confirmed 0-Day ★ Google Project Zero
Triaged: March 3, 2026 7 articles
VulnLookup ↗ NVD ↗ MITRE ↗ Advisory ↗ P0 Sheet ↗ CISA KEV ↗

EPSS Score

Source: FIRST.org · 2026-05-24
9.78%
probability
This CVE has a 9.78% probability of being exploited in the next 30 days.
0% Top 93.1th percentile of all CVEs 100%
CVSS score unavailable
Neither CIRCL nor NVD returned a CVSS score for this CVE. View on VulnerabilityLookup ↗

Description

Project Zero
OOB VMware ESXi

Attack Intelligence

Google Project Zero

Patched
March 4, 2025
Reported by
Microsoft Threat Intelligence Center
Root Cause Analysis
???

Signal Intelligence

Confidenceⓘ
92%
EPSS 9.78%
Mentions 7
Last Seen Jan 09, 2026

CNA Information

Analyst Note

This CVE merits confirmation with high confidence due to active in-the-wild exploitation by Chinese-linked threat actors since October 2024, inclusion in Google Project Zero research, and multiple credible security vendor reports documenting real-world attacks. The vulnerability's high CVSS score (8.2), arbitrary kernel write capability enabling sandbox escape, and evidence of exploitation predating official disclosure substantiate the confirmed status.

Threat Actors 32

APT27
apt_group Information theft and espionage 🇨🇳 CN
Cobalt
apt_group Financial crime 🇷🇺 RU
APT 28
apt_group Information theft and espionage 🇷🇺 RU
Cron
apt_group 🇷🇺 RU
Hacking Team
apt_group 🇮🇹 IT
The Shadow Brokers
apt_group 🇷🇺 RU
Infy
apt_group Information theft and espionage 🇮🇷 IR
Volt Typhoon
apt_group Information theft and espionage 🇨🇳 CN
Group 27
apt_group Information theft and espionage 🇨🇳 CN
BackdoorDiplomacy
apt_group Information theft and espionage 🇨🇳 CN
Lucky Cat
apt_group Information theft and espionage 🇨🇳 CN
[Unnamed group]
apt_group 🇨🇳 CN
Dark Caracal
apt_group Information theft and espionage 🇱🇧 LB
APT 22
apt_group Information theft and espionage 🇨🇳 CN
Cyber Av3ngers
apt_group Sabotage and destruction 🇮🇷 IR
Moonstone Sleet
apt_group 🇰🇷 KR
APT 6
apt_group Information theft and espionage 🇨🇳 CN
Red October
apt_group 🇷🇺 RU
Soft Cell
apt_group Information theft and espionage 🇨🇳 CN
The White Company
apt_group Information theft and espionage 🇨🇳 CN
Test Panda
apt_group 🇨🇳 CN
Pat Bear
apt_group 🇸🇾 SY
Operation Red Signature
apt_group Information theft and espionage 🇨🇳 CN
Unnamed Actor
apt_group 🇨🇳 CN
Shadow Network
apt_group Information theft and espionage 🇨🇳 CN
Mana Team
apt_group 🇨🇳 CN
Poisonous Panda
apt_group Information theft and espionage 🇨🇳 CN
Liminal Panda
apt_group 🇨🇳 CN
Big Panda
apt_group 🇨🇳 CN
APT 5
apt_group Information theft and espionage 🇨🇳 CN
Earth Berberoka
apt_group Information theft and espionage 🇨🇳 CN
Electric Panda
apt_group 🇨🇳 CN

Triage Info

Decided atMar 03, 2026