2025-07-28 - Version 2 Limited

How to find VMware ESXi installations on your network

Latest VMware ESXi vulnerabilities #

Broadcom has disclosed four vulnerabilities in certain versions of VMware ESXi, Workstation, Fusion, and Tools that, when combined, allow an adversary who already has privileged access (administrator or root) in a VM’s guest OS or has compromised a VM’s guest OS or services and gained privileged access to escape into the hypervisor and execute arbitrary code on the vulnerable system.

VMware ESXi, Workstation, and Fusion contain an integer-overflow vulnerability due to an out-of-bounds write in the VMXNET3 virtual network adapter. An adversary with local administrative privileges on a virtual machine with the VMXNET3 virtual network adapter may exploit the vulnerability and execute arbitrary code on the host. Non-VMXNET3 virtual adapters are not affected by the vulnerability. This vulnerability has been designated CVE-2025-41236 and has been rated critical with a CVSS score of 9.3.
VMware ESXi, Workstation, and Fusion contain an integer-underflow vulnerability due to an out-of-bounds write in the VMCI (Virtual Machine Communication Interface). An adversary with local administrative privileges on a virtual machine may exploit the vulnerability and execute arbitrary code as the virtual machine’s VMX process running on the host. On ESXi, the exploitation is contained within the VMX sandbox whereas, on Workstation and Fusion, this may lead to code execution on the Workstation or Fusion host machine. This vulnerability has been designated CVE-2025-41237 and has been rated critical with a CVSS score of 9.3.
VMware ESXi, Workstation, and Fusion contain a heap-overflow vulnerability in the PVSCSI (Paravirtualized SCSI) controller that leads to an out of-bounds write. An adversary with local administrative privileges on a virtual machine may exploit the vulnerability and execute arbitrary code as the virtual machine’s VMX process running on the host. On ESXi, the exploitation is contained within the VMX sandbox and exploitable only with configurations that are unsupported. On Workstation and Fusion, this may lead to code execution on the Workstation or Fusion host machine. This vulnerability has been designated CVE-2025-41238 and has been rated critical with a CVSS score of 9.3.
VMware ESXi, Workstation, Fusion, and VMware Tools contain an information disclosure vulnerability due to the usage of an uninitialised memory in vSockets. An adversary with local administrative privileges on a virtual machine may exploit the vulnerability and leak memory from processes communicating with vSockets. This vulnerability has been designated CVE-2025-41239 and has been rated high with a CVSS score of 7.1.

The following versions are affected

VMware ESXi versions 7.0 prior to 7.0.3 build-24784741
VMware ESXi versions 8.0 prior to 8.0.2 build-24789317
VMware ESXi versions 8.0 prior to 8.0.3 build-24784735
VMware Workstation version 17.x prior to 17.6.4
VMware Fusion version 13.x prior to 13.6.4
VMware Tools on Windows version 11.x.x or 12.x.x prior to 12.5.3
VMware Tools on Windows version 13.x.x prior to 13.0.1.0

What is the impact? #

Successful exploitation of these vulnerabilities would allow an adversary with privileged access in a VM’s guest OS to escape into the hypervisor and execute arbitrary code on the vulnerable system, potentially leading to complete system compromise.

Are updates or workarounds available? #

VMware has released updates for supported versions of the impact products to address these vulnerabilities. All users are urged to update as quickly as possible.

Product	Version	Fixed Version	Workarounds
ESXi	7.0	ESXi70U3w-24784741	None
ESXi	8.0	ESXi80U2e-24789317	None
ESXi	8.0	ESXi80U3f-24784735	None
Workstation	17.x	17.6.4	None
Fusion	13.x	13.6.4	None
Tools on Windows	11.x.x, 12.x.x	12.5.3	None
Tools on Windows	13.x.x	13.0.1.0	None

How to find VMware installations with runZero #

From the Asset Inventory, use the following query to locate assets running vulnerable versions of VMware ESXi:

os:"vmware esxi" AND ((os_version:>7 AND os_version:<"7.0.3 build-24784741") OR (os_version:>8 AND (os_version:<"8.0.2 build-24789317" OR os_version:<"8.0.3 build-24784735")))

Vulnerable versions of Workstation and Fusion can be found in the Software inventory using the following query:

vendor:vmware AND ((product:Workstation AND version:<17.6.4) OR (product:Fusion AND version:<13.6.4))

All versions of Workstation and Fusion can be found in the Software inventory using the following query:

vendor:vmware AND (product:Workstation OR product:Fusion)

March 2025: (CVE-2025-22224, CVE-2025-22225, CVE-2025-22226) #

On March 4th, 2025, Broadcom disclosed several vulnerabilities in all versions of its VMware ESXi, Workstation, and Fusion products. They also indicated that these are known to be exploited in the wild. Public information indicates that these vulnerabilities are potentially being leveraged by ransomware groups.

CVE-2025-22224 is rated critical with a CVSSv3 base score of 9.3. Successful exploitation of this vulnerability would allow a local administrative user in a guest virtual machine to execute arbitrary code as the guest virtual machine’s VMX process on a vulnerable host system. Impacts VMware ESXi and Workstation.
CVE-2025-22225 is rated important with a CVSSv3 base score of 8.2. Successful exploitation of this vulnerability would allow a malicious actor with privileges within the VMX process to trigger an arbitrary kernel write leading to an escape of the sandbox. Impacts VMware ESXi.
CVE-2025-22226 is rated important with a CVSSv3 base score of 7.1. Successful exploitation of this vulnerability would allow a local administrative user in a guest virtual machine to leak memory from the VMX process on a vulnerable host system. Impacts VMware ESXi, Workstation, and Fusion.

What is the impact? #

Upon successful exploitation of these vulnerabilities, an attacker with administrative rights in a guest virtual machine would be able to perform a VM Escape and execute code on the hypervisor host.

Are updates or workarounds available? #

VMware has released updates for supported versions of the impact products to address these vulnerabilities. All users are urged to update as quickly as possible. Users of unsupported version should review the download portals for their product to see if Broadcom has made patches available. They have reportedly done so for VMware ESXi 6.5 and 6.7. That said, Broadcom strongly encourages all customers using vSphere 6.5 and 6.7 to update to vSphere 8.

Product	Version	Fixed Version	Workarounds
ESXi	8.0	ESXi80U3d-24585383	None
ESXi	8.0	ESXi80U2d-24585300	None
ESXi	7.0	ESXi70U3s-24585291	None
ESXi	6.7	ESXi670-202503001	None
Workstation	17.x	17.6.3	None
Fusion	13.x	13.6.3	None

How to find VMware installations with runZero #

From the Asset Inventory, use the following query to locate assets running vulnerable versions of VMware ESXi:

os:"vmware esxi" AND (os_version:<6 OR (os_version:>6 AND os_version:<"6.7.0 build-24514018")   OR (os_version:>7 AND os_version:<"7.0.3 build-24585291") OR (os_version:>8 AND os_version:<"8.0.2") OR (os_version:>"8.0.2" AND os_version:<"8.0.2 build-24585300") OR (os_version:>"8.0.3" AND os_version:<"8.0.3 build-24585383"))

Additionally, using the runZero VMware integration, use the following Asset Inventory query to locate virtual machines running inside VMware, which could be potential sources of exploitation:

source:vmware

Vulnerable versions of Workstation and Fusion can be found in the Software inventory using the following query:

vendor:vmware AND ((product:Workstation AND version:<17.6.3) OR (product:Fusion AND version:<13.6.3))

All versions of Workstation and Fusion can be found in the Software inventory using the following query:

vendor:vmware AND (product:Workstation OR product:Fusion)

Multiple CVEs (June 2024) #

Broadcom has disclosed a vulnerability in their ESXi product that involves a domain group that could contain members that are granted full administrative access to the ESXi hypervisor host by default without proper validation.

CVE-2024-37085 is rated medium with CVSS score of 6.8 and allows an attacker with sufficient Active Directory (AD) permissions to bypass authentication.

What is the impact? #

A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management by re-creating the configured AD group (‘ESXi Admins’ by default) after it was deleted from AD. The three ways this can be exploited are:

1. Creating the AD group ‘ESX Admins’ to the domain and adding a user to it (known to be exploited in the wild)

2. Renaming another AD group in the domain to ‘ESX Admins’ and adding a new or existing user to it

3. Refreshing the privileges in the ESXi hypervisor when the ‘ESX Admin’ group is unassigned as the management group.

Are updates or workarounds available? #

Product	Version	Fixed Version	Workarounds
ESXi	8.0	ESXi80U3-24022510	KB369707
ESXi	7.0	No Patch Planned	KB369707
VMware Cloud Foundation	5.x	5.2	KB369707
VMware Cloud Foundation	4.x	No Patch Planned	KB369707

How to find potentially vulnerable systems runZero #

From the Asset Inventory, use the following query to locate systems running potentially vulnerable software:

os:ESXi

Additionally, using the runZero VMware integration, use the following query to locate virtual machines running inside VMware, which could be potential sources of exploitation:

source:vmware

Multiple CVEs (March 2024) #

On March 5th, 2024, VMware disclosed several vulnerabilities in its ESXi, Workstation, and Fusion products.

The vulnerabilities, reported as CVE-2024-22252, CVE-2024-22253, CVE-2024-22254, and CVE-2024-22255 allow code running inside virtual machines to access the host system in unauthorized ways.

The CVSS scores range from 7.1 (high) to 9.3 (critical); the vulnerabilities affecting ESXi are limited to high severity, but the vendor has indicated that taken together the vulnerabilities should be considered critical.

What is the impact? #

Upon successful exploitation of these vulnerabilities, an attacker who can execute code inside a virtual machine can access the host system and perform actions ranging from arbitrary code execution to sensitive information disclosure.

Are updates or workarounds available? #

VMware has released new versions of these products to address these vulnerabilities. All users are urged to update as quickly as possible.

How to find VMware installations with runZero #

From the Asset Inventory, use the following query to locate assets running potentially vulnerable versions of VMware ESXi or running VMware products:

os:ESXi

Additionally, using the runZero VMware integration, use the following query to locate virtual machines running inside VMware, which could be potential sources of exploitation:

source:vmware

Additional fingerprinting research is ongoing, and additional queries will be published as soon as possible.

CVE-2021-21974 (February 2023) #

In February 2023, popular hypervisor ESXi made the news due to fresh targeting by a new strain of ransomware. Known as ESXiArgs, this ransomware leveraged a 2-year old heap overflow issue in the OpenSLP service that can be used to execute remote code on exploitable targets (CVE-2021-21974). Many vulnerable public-facing ESXi servers had already been affected by this malware (at the time over 1,900 via Censys search results).

What was the impact? #

Targets of this new ransomware campaign were older ESXi servers running certain versions of 6.5, 6.7, or 7 releases and also had the OpenSLP service enabled (it has not been enabled by default in ESXi releases since 2021). Upon successful exploitation of CVE-2021-21974, the ESXiArgs ransomware encrypted a number of file types on the target system, including VM-related files with extensions .vmxf, .vmx, .vmdk, .vmsd, and .nvram. Ransom notes were saved as HTML files on compromised systems for admins and users to subsequently discover. While some of these ransom notes claim to have stolen data from vulnerable targets, no data exfiltration had been observed at the time.

VMware made patches available when the OpenSLP heap-overflow vulnerability was initially reported in 2021. The following ESXi releases had been patched against this attack vector and exploited by the ESXiArgs campaign:

ESXi version 7+ (ESXi70U1c-17325551 and later)
ESXi version 6.7+ (ESXi670-202102401-SG and later)
ESXi version 6.5+ (ESXi650-202102101-SG and later)

VMware also offered patched releases for Cloud Foundation (ESXi), which included an ESXi component:

Cloud Foundation (ESXi) version 4.2+
Patching instructions for Cloud Foundation (ESXi) version 3.x can be found here

Patching (and also ensuring that your ESXi servers were running a supported, not end-of-life/end-of-support version) was the best course of action. If patching was not a near-term option, VMware recommended mitigation via disabling the OpenSLP service.

About runZero
runZero, a network discovery and asset inventory solution, was founded in 2018 by HD Moore, the creator of Metasploit. HD envisioned a modern active discovery solution that could find and identify everything on a network–without credentials. As a security researcher and penetration tester, he often employed benign ways to get information leaks and piece them together to build device profiles. Eventually, this work led him to leverage applied research and the discovery techniques developed for security and penetration testing to create runZero.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

runZero 2025

Identity Security Intelligence: Why Identity Discovery is the Bedrock of Modern Risk Management

Blind spots in identity are today’s biggest security risk. Here’s how to fix them.‍

‍

In today’s hyper-connected and threat-saturated digital landscape, one truth is rapidly becoming self-evident to defenders across every industry: identity is the new perimeter, and access is the new security. As traditional network boundaries dissolve in favor of hybrid and cloud-first infrastructures, adversaries are increasingly pivoting toward the exploitation of identities—privileged accounts, service identities, orphaned users, misconfigured roles—as the primary path to breach and move laterally within environments.

But here’s the catch: you can’t protect what you don’t know exists. This is where Identity Security Intelligence becomes not just useful but essential. And at the core of that intelligence lies a foundational capability: Identity Discovery.

‍

What is Identity Security Intelligence?

Identity Security Intelligence (ISI) is the ability to aggregate, analyze, and act on data about identities, their associated roles, privileges, behaviors, and risks across the entirety of an organization’s infrastructure—from on-premises directories to SaaS applications and multi-cloud platforms.

Think of it as the intersection between Identity and Access Management (IAM), risk analytics, and threat detection. It’s not just about managing identities; it’s about understanding them deeply—who they are, what they can do, where they exist, and how they behave over time.

‍

The Foundation: Identity Discovery

Before an organization can reason intelligently about identity risk, it must first discover all identities that exist across its environment. This includes:

Traditional/On-Prem Identities: Users in Active Directory, service accounts in legacy apps, local admin accounts on servers, etc.
Cloud Identities: Identities in Azure AD, AWS IAM users and roles, Google Workspace users, cloud-native service principals, API keys, containers, and ephemeral workloads.
Shadow and Orphaned Identities: Legacy accounts no longer linked to active users, leftover access from decommissioned applications, services, and mismanaged credentials hiding in infrastructure-as-code.

A robust Identity Discovery capability surfaces all these identities, —whether they’re centralized or scattered, active or dormant, human or non-human.

‍

Why Identity Discovery is Challenging (Yet So Crucial)

The complexity arises from the fact that identity is now distributed. No longer tethered to one central directory, identities live in different silos across multiple environments and systems. Each cloud provider has its own model. Each SaaS app may define roles and entitlements differently. Each legacy system might still have its own local accounts.

This fragmented landscape creates massive blind spots:

Privileged accounts in cloud environments that bypass central logging.
Orphaned identities with persistent access to sensitive data.
Service accounts with excessive, never-reviewed permissions.
Redundant roles due to M&A, org restructuring, or tool proliferation.

Without discovery, these blind spots can easily lead to compromised credentials.

‍

Beyond Inventory: Discovering Roles, Privileges, and Entitlements

Discovery doesn’t stop at listing accounts. To enable true security intelligence, you must also map the roles, privileges, and entitlements tied to each identity.

This means answering questions like:

What can this identity do?
Where can it go?
What data can it access?
What systems does it control?
Are these privileges aligned with its purpose?

For example, discovering an AWS IAM user is useful. But understanding that the user has AdministratorAccess across multiple production accounts—and the account hasn’t logged in for 90 days—is critical.

Or take an identity in Microsoft 365 that has full mailbox access across HR, Finance, and Legal departments. Is that intended? Necessary? Or a remnant of an old project no one cleaned up?

Mapping these entitlements and privilege chains across your hybrid estate helps you:

Identify toxic combinations of access.
Enforce the principle of least privilege.
Detect privilege escalation paths.
Uncover misconfigurations before attackers do.

‍

Identity Risk: The Unseen Attack Surface

The more fragmented and complex your identity environment, the greater your exposure. Attackers thrive in this chaos.

From techniques like Kerberoasting, Golden SAML, and token theft, to exploiting cloud misconfigurations and unused admin roles, modern adversaries are experts at chaining together identity weaknesses and misconfigurations.

By contrast, organizations that maintain a comprehensive view of identity risk across the board can:

Detect anomalous behavior in context (e.g., a service account accessing finance systems for the first time).
Shut down dormant or orphaned accounts.
Flag privilege drift over time.
Simulate attack paths based on current entitlements.
Proactively remediate risk without waiting for incidents.

‍

What Makes Identity Security Intelligence Actionable?

Let’s be clear: data alone is not intelligence. Intelligence emerges when data is correlated, contextualized, and operationalized.

An effective Identity Security Intelligence program must provide:

Continuous Discovery: Real-time or near-real-time visibility into new, removed, or changed identities.
Entitlement Mapping: Deep visibility into fine-grained privileges across cloud and on-prem environments.
Risk Analytics: Automated scoring based on behavior, privilege level, and exposure.
Historical Context: Identity behavior over time—who did what, when, and whether it deviated from the norm.
Integrations: Feeds into SIEM, SOAR, and IAM/PAM platforms for proactive and reactive response.

This turns identity data into strategic insight—fuel for critical decisions in security operations, compliance, audits, and incident response.

‍

Getting Started: Build Your Identity Intelligence Baseline

If your organization is just starting down this path, here’s a basic roadmap:

Inventory all identities—human, service, machine—across on-prem and cloud.
Map entitlements for each identity across applications, infrastructure, and data.
Assess privilege levels and compare against business needs and least privilege standards.
Identify toxic combinations—privilege escalations, cross-boundary access, unused high-risk roles.
Establish continuous discovery and monitoring, not just point-in-time scans.
Feed this intelligence into your risk models and threat detection systems.

‍

The Bottom Line

In the same way that endpoint detection changed the game a decade ago, Identity Security Intelligence is becoming table stakes for defending against modern threats. Attackers know that identity is the weakest link in many organizations. Our job as defenders is to turn it into a strength.

By investing in identity discovery—including deep insight into roles, entitlements, and privileges—you build a clear, contextual picture of your true identity surface. Only then can you manage it, reduce it, and defend it with confidence.

In a world where credentials are more valuable than malware, identity intelligence isn’t just good hygiene—it’s your first line of defense.

About Segura®
Segura® strive to ensure the sovereignty of companies over actions and privileged information. To this end, we work against data theft through traceability of administrator actions on networks, servers, databases and a multitude of devices. In addition, we pursue compliance with auditing requirements and the most demanding standards, including PCI DSS, Sarbanes-Oxley, ISO 27001 and HIPAA.

2025 Segura

More visibility to admins: Failed Logins data and revamped Dashboards

Summary: NordLayer’s new Failed Logins data and revamped Dashboards offer instant visibility, detailed logs, and clearer insights to enhance proactive threat detection.

Every access attempt to your network is significant—and quickly detecting unusual patterns can be critical for protecting your organization’s sensitive data. While occasional failed logins are normal, a sudden surge in login attempts can indicate brute-force attacks, signaling that someone may be trying to gain unauthorized access.

At NordLayer, we’re committed to protecting what matters most to your business while keeping security simple to manage. That’s why we continue to improve the Control Panel, which gives IT teams greater visibility and monitoring capabilities. These updates are part of our mission to provide layered, proactive protection without disrupting daily operations, helping you stay ahead of modern risks with confidence.

Instant visibility with the Failed Logins data

We’re introducing powerful new Failed Logins data within your Control Panel’s Dashboards section. It provides an overview of suspicious or unauthorized access attempts across your NordLayer Control Panel, apps, and Browser Extension—whether users log in via SSO or email/password, with or without 2FA.

Now, you’ll find a dedicated Failed Logins widget and graph that offers visibility into:

The number of attempts to log in within 24 hours
Trends that might indicate a targeted brute force attack
Anomalies that require your immediate attention

NordLayer Dashboards Security category displaying Failed Logins widget and graph, and the percentage of 2FA enablement

This instant insight helps you spot potential threats early, allowing you to stay in control and act before issues escalate. It’s a proactive approach to mitigating security risks.

Activity section upgrade—detailed Failed Logins log

To complement the Dashboards feature, we’ve also improved the Activity section. Now, a detailed Failed Logins log is available, providing 24-hour data and granular context for each unsuccessful access attempt.

NordLayer Control Panel showing Failed Logins log for monitoring suspicious login attempts

This comprehensive log equips IT admins with crucial information, including:

Name and email—who attempted to log in
Exact date and time—when the attempt occurred
Device IP address—the location of the attempt
Device or browser Information—what was used
Login method—SSO or email and password
Failure reason—which part of the login process failed
Number of failed attempts (per session)—to identify persistent efforts
Role (owner, member, etc.)—context about the user’s permissions
Status of the user—active, invited, etc

This level of visibility empowers your team to react faster to anomalies, investigate suspicious patterns thoroughly, and strengthens your overall threat response strategy with confidence.

By analyzing these patterns, admins can detect anomalies in user behavior, which may indicate brute force attacks, compromised accounts, or insider threats.

Dashboards overview

Beyond the new Failed Logins data, our redesigned Dashboards experience makes your security and usage insights clearer and more actionable.

Your NordLayer Dashboards continue to offer a wealth of valuable information, including:

User activity. Monitor who is connecting, when, and from where.
Throughput usage. Track data consumption across your network.
Server load. Keep an eye on performance and optimize resource allocation.
Connection trends. Understand network patterns and peak usage times.

These insights are vital for optimizing network performance, managing user access, and maintaining a robust security posture, all from a centralized control point.

Usage vs. Security categories

We’re restructuring the dashboard to improve clarity and streamline your experience. You’ll now find insights clearly grouped under two new, intuitive categories: Usage and Security.

Usage

This section provides an overview of network activity, throughput consumption, and user engagement, helping you manage resources efficiently. You’ll still find familiar visualizations, including:

Graphs for sessions, protocols, server bandwidth
Donut charts for device OS distribution, browser type distribution, and NordLayer client versions

Security

This new dedicated section consolidates all critical security-related data, including the new Failed Logins data, threat alerts, compliance-related metrics, and 2FA enablement percentages. This clear separation ensures that your most vital security information is easily accessible, allowing for rapid assessment and decision-making.

The new structure not only simplifies navigation but also makes it easier to focus on specific areas of your network’s performance and security health.

Why it matters

These updates are more than just new additions; they’re about giving IT admins and organization owners better visibility and monitoring capabilities for proactive security and streamlined operations.

Monitor failed logins to instantly spot potential unauthorized access attempts or brute-force attacks, helping mitigate security risks before they escalate.
Gain deeper insights into user behavior patterns to detect anomalies indicating compromised accounts or insider threats.
Enforce stricter access controls and align with Zero Trust principles by continually verifying access based on failed login data. This allows you to quickly implement additional authentication measures or adjust permissions when suspicious activity is detected.
When a spike in failed logins occurs, quickly investigate, block suspicious IPs, or temporarily suspend accounts, reducing response time and minimizing exposure.
Contribute to audit trails with detailed logs of failed login attempts for compliance with regulations like GDPR and HIPAA, fostering accountability and demonstrating due diligence.
Highlight areas where users might need additional training on password management or where access policies require refinement, such as implementing MFA for frequent failures.

By providing clear, actionable intelligence, NordLayer helps your organization detect threats early, stay in control, and act before issues escalate into significant incidents.

Final thoughts

The new Failed Logins data and the redesigned Dashboards experience represent a significant step forward in improving your cybersecurity with NordLayer. These tools will give you greater peace of mind and more effective control over your network’s security, empowering you to manage complex challenges with greater efficiency.

We encourage you to log into your Control Panel today, explore the new Dashboards categories, and use the data to strengthen your threat detection and response strategies.

Your proactive security journey just got a powerful upgrade.

About Nord Security
The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

About NordLayer
NordLayer is an adaptive network access security solution for modern businesses – from the world’s most trusted cybersecurity brand, Nord Security.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

Nord Security NordLayer 2025