#vmware

Analysis · May 8, 2026 · The Field Notes Desk

Broadcom turned an ESXi zero-day into a patch-access crisis

CVE-2025-22225 was exploited for over a year before Broadcom patched it. Then perpetual license holders couldn't download the fix.