Key Takeaways
- The critical VMware ESXi vulnerability (CVE-2025-22225) is now actively exploited by ransomware groups in the wild, as confirmed by CISA.
- The flaw allows attackers with privileges in the VMX process to trigger arbitrary kernel writes, enabling virtual machine sandbox escapes.
- Evidence suggests Chinese threat actors have been exploiting this vulnerability since February 2024, approximately one year before its disclosure.
- Multiple VMware products are affected, including ESXi, Fusion, Cloud Foundation, vSphere, Workstation, and Telco Cloud Platform.
- Organizations should immediately apply Broadcom’s March 2025 security patches and implement additional defense measures to protect against these attacks.
Cybersecurity teams across the globe are on high alert as the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that ransomware operators are actively exploiting a dangerous vulnerability in VMware ESXi. This critical development represents a significant escalation in the threat landscape for organizations using virtualized environments. Protecting your virtualized infrastructure has never been more urgent with these new attacks targeting a core technology used by countless enterprises.
The vulnerability in question, CVE-2025-22225, allows attackers to escape virtual machine sandboxes—essentially breaking out of the isolation that normally contains virtualized systems. This serious security flaw, patched by Broadcom in March 2025, has made its way onto CISA’s Known Exploited Vulnerabilities (KEV) catalog, signaling its active exploitation in ransomware campaigns. The timing of this warning suggests a rapidly evolving threat that security teams must address with utmost urgency.
VMware ESXi Vulnerability Now Actively Used in Ransomware Attacks
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirmed on Wednesday that ransomware gangs have begun weaponizing a high-severity VMware ESXi sandbox escape vulnerability. This flaw, previously identified as a zero-day exploit, enables attackers to break out of virtualized environments and potentially take control of entire server infrastructures. What makes this particularly concerning is that the vulnerability impacts widely deployed enterprise virtualization technology, potentially affecting thousands of organizations worldwide.
This arbitrary-write vulnerability, tracked as CVE-2025-22225, represents a critical security issue that allows privileged attackers within a virtual machine to execute code on the host system. Security researchers have observed sophisticated attack chains that leverage this vulnerability alongside other VMware flaws to achieve maximum impact. The attacks appear well-coordinated and demonstrate an advanced understanding of VMware’s architecture, suggesting the involvement of highly skilled threat actors.
CISA’s warning specifically highlights the ransomware dimension of these attacks, indicating that criminal groups have now incorporated this exploit into their arsenal. While the agency did not explicitly name the ransomware gangs involved, this development follows a concerning pattern of sophisticated threat actors quickly adopting newly disclosed vulnerabilities for financial gain. The potential impact of these attacks includes data encryption, business disruption, and significant recovery costs for affected organizations.
“A malicious actor with privileges within the VMX process may trigger an arbitrary kernel write leading to an escape of the sandbox,” Broadcom stated in their security advisory about the CVE-2025-22225 vulnerability. This technical description highlights the severity of the issue, as sandbox escapes essentially neutralize the security boundaries that virtualization is designed to enforce.
Technical Details of the CVE-2025-22225 Vulnerability
The CVE-2025-22225 vulnerability represents a significant security flaw in VMware’s ESXi hypervisor, allowing attackers to escape from virtual machine environments. At its core, this arbitrary write vulnerability enables privileged attackers within a virtual machine to write data to the ESXi kernel, effectively breaking out of the sandbox designed to isolate virtualized systems from the host. This capability undermines one of virtualization’s fundamental security principles—the isolation between guest systems and the host environment.
The technical mechanism involves manipulating the VMX process, which manages virtual machine execution, to trigger unintended writes to kernel memory locations. When successfully exploited, this vulnerability allows attackers to execute code with the same privileges as the hypervisor itself. The impact is severe because hypervisors typically run with the highest system privileges, giving attackers complete control over the host and all virtual machines running on it.
How the Sandbox Escape Vulnerability Works
The sandbox escape vulnerability exploits a fundamental weakness in how VMware ESXi handles certain memory operations between the virtualized environment and the host system. When a privileged user within the virtual machine initiates specific operations, the vulnerability allows them to manipulate kernel memory addresses in ways that should be restricted. This manipulation creates an opportunity for malicious actors to write arbitrary data to sensitive memory locations in the hypervisor.
The attack sequence typically begins with the attacker gaining administrator or root access within a virtual machine, which might be achieved through conventional methods like phishing or exploiting other vulnerabilities. Once inside with elevated privileges, the attacker can trigger the vulnerability by executing specially crafted code that interacts with the VMX process in unexpected ways. The result is the ability to write to memory locations that should be inaccessible, effectively breaking the containment that virtualization provides.
What makes this vulnerability particularly dangerous is that it bypasses the security architecture that organizations rely on to isolate workloads and contain potential compromises. Many security strategies depend on the assumption that virtual machine compromises remain contained within their virtualized environment, but this vulnerability fundamentally breaks that assumption. The arbitrary kernel write capability essentially gives attackers a direct path from controlling a single virtual machine to compromising the entire virtualized infrastructure.
Connected Vulnerabilities in the Attack Chain
Broadcom patched CVE-2025-22225 alongside two other critical vulnerabilities—CVE-2025-22226 (a memory leak) and CVE-2025-22224 (a time-of-check time-of-use race condition). These vulnerabilities form a dangerous triad that attackers can chain together for maximum impact. The memory leak vulnerability provides attackers with valuable information about the hypervisor’s memory layout, which can be crucial for successfully exploiting the arbitrary write flaw.
The TOCTOU race condition (CVE-2025-22224) creates additional opportunities for attackers by allowing them to exploit timing differences between when the system checks permissions and when it performs operations. This vulnerability leads to an out-of-bounds write condition that further compromises the system’s integrity. Security researchers have observed sophisticated attackers leveraging all three vulnerabilities in sequence, demonstrating a coordinated approach to compromising VMware environments.
Systems at Risk
The vulnerability affects a wide range of VMware products beyond just ESXi, including VMware Fusion, Cloud Foundation, vSphere, Workstation, and Telco Cloud Platform. This broad impact means that virtually any organization using VMware’s virtualization stack could be at risk if unpatched. The vulnerability’s severity is amplified by the fact that these products form the foundation of many organizations’ IT infrastructure, hosting critical business applications and sensitive data.
Organizations in sectors that heavily rely on virtualization—such as cloud service providers, financial institutions, healthcare organizations, and government agencies—face particularly high risks from this vulnerability. The potential impact extends beyond direct ransomware attacks to include data theft, operational disruption, and regulatory compliance issues. As virtualization often hosts an organization’s crown jewels, the compromise of these systems can have devastating consequences for business continuity and data protection.
Timeline of Exploitation and Discovery
The exploitation timeline of this vulnerability reveals a concerning pattern where attackers had access to these zero-day flaws long before public disclosure. Security professionals are now piecing together evidence that suggests sophisticated threat actors had knowledge of and were actively exploiting these vulnerabilities months before they were officially identified. This extended window of undisclosed exploitation highlights the advanced capabilities of certain threat groups and underscores the challenges of detecting sophisticated attacks against virtualization infrastructure.
Broadcom’s security response included patches released in March 2025, but the full scope and duration of attacks exploiting these vulnerabilities before disclosure remains under investigation. The gap between initial exploitation and vendor patching represents a significant period where organizations were vulnerable without any available remediation. This situation emphasizes the importance of defense-in-depth strategies that don’t rely solely on patching known vulnerabilities.
Zero-Day Attacks Dating Back to February 2024
According to research published by cybersecurity company Huntress, Chinese-speaking threat actors likely began exploiting these vulnerabilities as early as February 2024, approximately one year before their public disclosure. This extended period of undetected exploitation is particularly troubling as it suggests that sophisticated attackers had ample time to compromise systems and establish persistent access to targeted networks. The technical sophistication required to discover and weaponize these vulnerabilities indicates the involvement of advanced persistent threat (APT) groups rather than ordinary cybercriminals.
The long exploitation timeline also raises questions about how many organizations may have been compromised before patches were available. During this year-long window, attackers could have established backdoors, exfiltrated sensitive data, or prepared for later attacks—all while security teams had no knowledge of the vulnerability. This scenario represents one of the most dangerous aspects of zero-day exploits: the inability to defend against unknown threats.
Broadcom’s March 2025 Patch Release
Broadcom (which acquired VMware) released patches for all three vulnerabilities in March 2025, addressing CVE-2025-22225 alongside the related flaws CVE-2025-22226 and CVE-2025-22224. The security updates were published with advisories acknowledging that these vulnerabilities were being actively exploited in the wild. This acknowledgment marked the transition of these vulnerabilities from zero-days to known exploited vulnerabilities, though remediation would still take time as organizations implemented the patches across their environments.
The patch release provided crucial technical details about the vulnerabilities, enabling security researchers to better understand the mechanisms of attack and develop detection strategies. However, as with many major security patches, organizations faced challenges in quickly testing and deploying updates across production environments. This inevitable delay between patch availability and widespread implementation created an opportunity for ransomware operators to target unpatched systems.
CISA’s Recent Ransomware Warning
CISA’s Wednesday update to its Known Exploited Vulnerabilities (KEV) catalog specifically highlighted CVE-2025-22225 as being actively exploited in ransomware campaigns. This warning represents a significant escalation, as it indicates that the vulnerability has moved beyond targeted espionage by sophisticated actors to broader criminal exploitation. The inclusion in the KEV catalog also triggers mandatory remediation timelines for federal agencies under Binding Operational Directive (BOD) 22-01, requiring them to patch affected systems within specific timeframes.
While CISA didn’t provide specific details about the ransomware operations exploiting this vulnerability, the agency’s warning suggests that multiple ransomware groups may have incorporated this exploit into their attack chains. This development follows a common pattern where initial exploitation by sophisticated actors is followed by broader adoption among cybercriminal groups once the vulnerabilities become public knowledge. The transition from targeted exploitation to ransomware campaigns typically results in less discriminate targeting and potentially more widespread impact.
Why Ransomware Groups Target VMware Products
Ransomware operators gravitate toward VMware products for several strategic reasons that maximize their potential impact and financial return. The centralized nature of virtualization platforms makes them particularly attractive targets, as a single compromise can affect numerous virtual machines and their data. By targeting the hypervisor layer, attackers can potentially encrypt large volumes of business-critical data with minimal effort, creating maximum leverage for ransom demands.
The critical business functions typically hosted on virtualization infrastructure further increase the pressure on victims to pay ransoms quickly. When core business applications become inaccessible due to a virtualization-level attack, organizations face immediate and severe operational disruptions that can rapidly translate to financial losses. This pressure creates favorable conditions for ransomware operators seeking quick payments from desperate victims.
Access to Critical Business Data
VMware infrastructure typically hosts an organization’s most valuable data assets and critical business applications, making it an ideal target for ransomware operators seeking maximum impact. Virtual environments often consolidate numerous workloads and data repositories that would previously have been distributed across separate physical systems, creating a concentrated target rich with valuable information. When attackers compromise the virtualization layer, they potentially gain access to all the virtual machines running on that infrastructure, including database servers, file repositories, and business applications containing sensitive data.
Historical Success with ESXi Exploits
Ransomware groups have a documented history of successfully targeting VMware ESXi environments, which has reinforced their focus on these systems. Previous campaigns targeting ESXi vulnerabilities have demonstrated the effectiveness of this approach, with some attacks compromising thousands of servers worldwide. The “ESXiArgs” ransomware campaign of early 2023, for example, exploited a two-year-old vulnerability to target unpatched ESXi servers, encrypting virtual machines and causing significant business disruptions. These past successes have established virtualization infrastructure as a proven high-value target in ransomware operators’ playbooks.
5 Critical Mitigation Steps for Businesses
Organizations running VMware infrastructure must take immediate action to protect against these active threats. The multi-faceted nature of these attacks requires a comprehensive security response that addresses not only patching but also detection, containment, and recovery capabilities. Security teams should prioritize these vulnerabilities in their remediation efforts given the confirmed ransomware exploitation and the critical nature of the systems at risk.
1. Apply Vendor Patches Immediately
The single most important step organizations can take is to apply Broadcom’s security patches for the affected VMware products without delay. These patches directly address the vulnerabilities being exploited in the wild and provide the most effective protection against current attack methods. Security teams should identify all instances of vulnerable VMware products in their environment, prioritize them based on exposure and criticality, and implement a rapid patching schedule.
For organizations with complex environments, establishing a clear patching workflow that includes testing in non-production environments followed by careful production deployment can help manage the process efficiently. However, given the active exploitation, the traditional testing cycle may need to be accelerated or modified to reduce the window of vulnerability. In cases where production patches must be delayed, additional compensating controls should be implemented to reduce risk during the interim period.
2. Implement Network Segmentation
Effective network segmentation can limit an attacker’s ability to move laterally after exploiting the VMware vulnerabilities. By isolating virtualization management networks from other business systems, organizations can create barriers that contain potential breaches and prevent attackers from reaching critical assets. Implementing strict access controls at network boundaries, using firewalls with deep packet inspection, and restricting management interface accessibility can significantly reduce the attack surface.
Organizations should review their current network architecture to identify any direct paths between internet-facing systems and virtualization management interfaces. Management networks should be isolated behind multiple security layers and accessible only through secure, authenticated connections such as VPNs or jump servers with multi-factor authentication. These measures create additional obstacles for attackers even if they successfully exploit the initial vulnerability.
3. Monitor for Suspicious Activity
Implement enhanced monitoring across virtualization environments to detect potential exploitation attempts or suspicious activities related to these vulnerabilities. Security teams should configure logging to capture relevant events at the hypervisor level and establish automated alerting for known indicators of compromise. Monitoring should focus on unusual authentication attempts to management interfaces, unexpected communication between virtual machines and external systems, and any attempts to modify hypervisor configurations outside of change control processes.
Consider deploying specialized security tools designed for virtualization environments that can provide visibility into VM-to-VM traffic and hypervisor activities. Solutions that support East-West traffic monitoring within virtual environments can help identify lateral movement that might otherwise remain invisible to perimeter security controls. Additionally, monitoring for ransomware precursors—such as reconnaissance activities, privilege escalation attempts, and data staging—can provide early warning of potential attacks.
4. Back Up Critical Data
Ensure comprehensive backups of virtualization infrastructure components, including virtual machine configurations, data stores, and management systems. These backups must be stored securely, isolated from the production environment, and regularly tested to verify restoration capabilities. Implement the 3-2-1 backup strategy: maintain at least three copies of data on two different storage media with one copy stored offsite or in an air-gapped environment inaccessible from the production network.
Pay special attention to backing up critical virtualization management components, including vCenter servers and ESXi host configurations. In the event of a successful ransomware attack, having these configurations backed up can significantly accelerate recovery efforts. Regularly test the entire restoration process to identify any potential issues before they affect real recovery operations during an incident.
5. Follow CISA BOD 22-01 Guidance
CISA’s Binding Operational Directive 22-01 requires federal agencies to remediate known exploited vulnerabilities within specific timeframes, but its guidance serves as a valuable framework for all organizations. Even for non-federal entities, the directive provides a structured approach to addressing high-risk vulnerabilities with known exploitation. Following this guidance means prioritizing the remediation of vulnerabilities listed in the KEV catalog, including CVE-2025-22225, and implementing a regular process for identifying and addressing newly listed vulnerabilities.
The directive also emphasizes the importance of maintaining an accurate asset inventory, which is critical for identifying all instances of affected VMware products within an environment. Organizations should leverage their configuration management databases or conduct discovery scans to ensure they have visibility into all potentially vulnerable systems. This comprehensive inventory enables more effective patch management and reduces the risk of overlooking vulnerable systems.
What Happens If You Can’t Patch Right Away
For organizations unable to immediately apply patches due to operational constraints or complex testing requirements, implementing compensating controls becomes essential. These temporary measures can reduce risk while patch testing and deployment proceed according to established change management processes. However, these controls should be viewed as interim solutions rather than permanent alternatives to patching, given the severity of the vulnerabilities and their active exploitation.
Temporary Workarounds
If patching must be delayed, consider implementing strict access controls to management interfaces, removing direct internet accessibility to ESXi hosts, and requiring all management access to pass through secure jump servers with enhanced monitoring. Additionally, restrict administrative privileges to the absolute minimum necessary personnel and implement just-in-time access management for administrative functions. For critical environments, consider temporarily migrating workloads to alternative infrastructure if possible, or implementing additional monitoring specifically focused on detecting the exploitation patterns associated with these vulnerabilities.
Network-level controls can also provide temporary protection by restricting communication patterns typically associated with exploitation attempts. Implementing strict egress filtering to prevent unauthorized outbound connections from virtual machines can limit an attacker’s ability to establish command and control channels or exfiltrate data. Similarly, restricting inbound connectivity to management interfaces to only authorized management workstations can reduce the attack surface until patching can be completed.
Risk Assessment Considerations
When prioritizing systems for patching, conduct a thorough risk assessment that considers both the likelihood of exploitation and the potential impact of compromise. Systems directly accessible from the internet, hosting critical business functions, or containing sensitive data should receive the highest priority. The assessment should also consider dependencies between systems—compromising a less critical system might provide attackers with a pathway to more valuable targets through network connectivity or shared credentials.
Document your risk acceptance decisions and compensating controls to demonstrate due diligence in addressing the vulnerabilities. This documentation becomes particularly important for regulatory compliance and potential insurance considerations in the event of an incident. Ensure senior leadership is aware of the risks associated with delayed patching and has formally acknowledged the organization’s approach to managing those risks during the interim period.
The Bigger Picture: VMware’s Security Challenges
The current situation with CVE-2025-22225 exists within a broader context of security challenges faced by virtualization technologies. Understanding this larger pattern provides important perspective for organizations developing long-term security strategies around their virtualized infrastructure. The recurring nature of critical vulnerabilities in virtualization platforms highlights the need for comprehensive security approaches beyond reactive patching.
Recent History of Critical Vulnerabilities
VMware products have experienced several high-impact vulnerabilities in recent years that have attracted significant attention from threat actors. In January 2026, CISA flagged a critical VMware vCenter Server vulnerability (CVE-2024-37079) as actively exploited in the wild. Prior to that, CISA directed federal agencies to patch a high-severity vulnerability (CVE-2025-41244) affecting VMware Aria Operations and VMware Tools. This pattern of recurring critical vulnerabilities in core virtualization components creates a challenging security landscape for organizations heavily invested in VMware technology.
Chinese Threat Actor Involvement
Security researchers have identified patterns suggesting that Chinese-speaking threat actors played a significant role in exploiting these VMware vulnerabilities before their public disclosure. According to reports from cybersecurity company Huntress, evidence indicates these actors likely began exploiting the vulnerabilities as early as February 2024, approximately a year before they were officially identified and patched. This extended period of zero-day exploitation demonstrates the sophisticated capabilities and resources available to these threat actors.
The targeting patterns associated with these attacks suggest state-sponsored or state-affiliated threat actors with interests in long-term intelligence gathering rather than immediate financial gain. However, the transition to ransomware exploitation represents a concerning evolution where sophisticated attack techniques originally developed for espionage are now being leveraged by criminal organizations for profit. This pattern of capability transfer from nation-state actors to criminal groups continues to elevate the threat landscape for all organizations.
Protect Your Business Now
With ransomware groups actively exploiting the VMware ESXi vulnerability, organizations must take immediate action to secure their virtualization infrastructure. Implement the five critical mitigation steps outlined above, starting with identifying all vulnerable systems and applying available patches. Remember that a defense-in-depth approach—combining patching, monitoring, access controls, and backup strategies—provides the most effective protection against these sophisticated attacks.
Engage with trusted security partners and information-sharing communities to stay informed about emerging threats targeting virtualization infrastructure. The rapidly evolving nature of these attacks means that new exploitation techniques or indicators of compromise may emerge even after initial remediation efforts. Continuous vigilance and adaptability are essential components of an effective security posture in today’s threat landscape. CyberSecure Solutions provides comprehensive vulnerability assessment services specifically designed to identify and remediate virtualization security risks.
Frequently Asked Questions
As organizations respond to this critical vulnerability, security teams commonly encounter several questions about the nature of the threat and appropriate response measures. The following FAQs address the most pressing concerns based on current understanding of the vulnerability and associated attacks. However, as the situation evolves, organizations should continue to monitor updates from CISA and Broadcom for the latest information.
These answers reflect best practices based on current information, but security teams should always adapt recommendations to their specific environments and risk profiles. When in doubt, consult with security professionals experienced in virtualization infrastructure protection to develop tailored response strategies.
What exactly is CVE-2025-22225 and how does it work?
CVE-2025-22225 is an arbitrary write vulnerability in VMware ESXi that allows attackers with privileges within the VMX process to trigger kernel writes that lead to a sandbox escape. In practical terms, this means an attacker who has gained administrative access to a virtual machine can potentially break out of that VM’s isolation and gain control over the underlying hypervisor. The vulnerability exploits weaknesses in how the ESXi hypervisor handles certain memory operations, allowing privileged code running inside a virtual machine to write data to restricted memory locations in the hypervisor kernel.
Which versions of VMware ESXi are affected by this vulnerability?
The vulnerability affects multiple VMware products, including ESXi, Fusion, Cloud Foundation, vSphere, Workstation, and Telco Cloud Platform. Specific version information can be found in Broadcom’s security advisory, but generally, most versions released before the March 2025 security patches are vulnerable. Organizations should check the exact version numbers of their deployed products against the advisory to determine their exposure.
Even older versions that might not be explicitly mentioned in the advisory should be considered potentially vulnerable if they haven’t received recent security updates. Systems running end-of-life versions that no longer receive security patches present particularly high risk and should be prioritized for upgrading or decommissioning.
How can I tell if my systems have been compromised?
Detecting compromise requires examining both hypervisor-level and virtual machine-level indicators. Look for unusual authentication attempts to management interfaces, unexpected communication patterns between VMs and external systems, modifications to hypervisor configurations outside change control processes, and any signs of data encryption or ransomware activity. Security teams should review logs from vCenter Server, ESXi hosts, and virtual machine operating systems for suspicious activities.
Advanced detection might involve memory forensics of the hypervisor and virtual machines, examination of network traffic patterns, and analysis of authentication logs for unauthorized access. Organizations with security information and event management (SIEM) systems should develop custom detection rules based on the latest threat intelligence about these attacks. If compromise is suspected, consider engaging specialized forensic expertise to conduct a thorough investigation.
What should I do if I can’t patch immediately?
If immediate patching isn’t possible, implement strong compensating controls to reduce risk while preparing for patching. Restrict network access to management interfaces, implement strict access controls with multi-factor authentication for all administrative access, enhance monitoring for suspicious activities, and ensure comprehensive backups are maintained in isolated environments. Consider temporarily disconnecting internet access for critical virtualization infrastructure if operationally feasible, or implementing more restrictive network filtering to limit potential attack vectors.
Who is behind these ransomware attacks?
While CISA hasn’t specifically identified the ransomware groups exploiting this vulnerability, the pattern follows typical capability transfer from sophisticated actors to criminal organizations. Initial exploitation appears linked to Chinese-speaking threat actors with advanced capabilities, but the vulnerability has now made its way into ransomware operations. This evolution follows a common pattern where zero-day vulnerabilities initially exploited by nation-state actors are later adopted by financially motivated criminal groups once the vulnerabilities become publicly known.
How does this vulnerability compare to previous VMware ESXi exploits?
CVE-2025-22225 represents a particularly serious threat compared to previous ESXi vulnerabilities due to its sandbox escape capabilities and its active exploitation as a zero-day for approximately a year before disclosure. While previous campaigns like ESXiArgs targeted older vulnerabilities with publicly available exploits, this vulnerability was being exploited before public awareness or patches existed. The severity is amplified by its combination with other vulnerabilities (CVE-2025-22226 and CVE-2025-22224) that together create a powerful attack chain capable of completely compromising virtualization infrastructure.
What resources has CISA provided for affected organizations?
CISA has added CVE-2025-22225 to its Known Exploited Vulnerabilities (KEV) catalog, triggering remediation requirements for federal agencies under BOD 22-01. Additionally, CISA provides technical advisories, detection guidance, and incident response recommendations through their website and information sharing platforms. Organizations should monitor the CISA website and subscribe to their alert services for the latest updates on this and other actively exploited vulnerabilities. The agency also offers various resources for vulnerability management best practices and ransomware prevention through their Shields Up campaign.
“Ransomware gangs and state-sponsored hacking groups often target VMware vulnerabilities because VMware products are widely deployed on enterprise systems that commonly store sensitive corporate data.” – CISA Advisory Statement
Organizations that discover indicators of compromise related to these vulnerabilities should report them to CISA and consider sharing information through industry ISACs (Information Sharing and Analysis Centers) to help the broader community detect and respond to these threats. Collaborative defense through information sharing represents one of the most effective strategies against sophisticated threats targeting widely used technologies like VMware ESXi.
