Three VMware Zero-Days Exploited—Are You At Risk?

## Executive Summary Broadcom/Microsoft (MSTIC) disclosed three zero-day VMware vulnerabilities (CVE-2024-22224/22225/22226) affecting ESXi, Workstation, and Fusion that enable arbitrary code execution, sandbox escapes via kernel writes, and information disclosure; CVSS scores range from 7.1 to 9.3. The vendor confirms real-world exploitation; patches and fixed versions for affected products have been published and organizations are advised to patch immediately and strengthen monitoring and access controls.