In February 2023 a ransomware campaign called ESXiArgs encrypted thousands of VMware ESXi servers within a few days. It apparently got in through a flaw in an ESXi service that VMware had patched two years earlier. Each hypervisor it reached took down every virtual machine on it at once, however well each guest's own operating system had been maintained.
On the CompTIA Security+ SY0-801 exam, weaknesses like this sit under objective 2.4, which expects you to recognize the kinds of vulnerabilities organizations carry and the places attackers find them. This lesson covers four of them: flaws in the operating system, weaknesses in virtualization, zero-days that have no patch yet, and cryptographic vulnerabilities that come from weak choices rather than broken math.
OS vulnerabilities put everything that runs on the system at risk
The operating system enforces file permissions, keeps one process's memory apart from another's, holds encryption keys in memory and runs the security tools themselves. A flaw in the OS can defeat all of those controls at once.
OS vulnerabilities fall into a few recurring shapes:
- Local privilege escalation: a bug in the kernel or a privileged component lets an ordinary user become root or SYSTEM. PwnKit (CVE-2021-4034) sat in the pkexec tool on most major Linux distributions for more than 12 years before it was found.
- Remote code execution in built-in network services: EternalBlue in SMBv1 (fixed by MS17-010), BlueKeep in Remote Desktop (CVE-2019-0708) and PrintNightmare in the Print Spooler (CVE-2021-34527) all let attackers run code over the network, the first two without any credentials.
- Vulnerable drivers: drivers run inside the kernel, so a signed but flawed driver is a way in. Attackers increasingly bring their own vulnerable driver (BYOVD), load it with admin rights and use it to switch off EDR. Windows 11 now blocks a list of known vulnerable drivers by default.
- Features enabled by default: services that run whether the system needs them or not. After PrintNightmare, CISA ordered federal agencies to disable the Print Spooler on domain controllers, which rarely print anything.
The fixes are the basics, done consistently: install OS updates on a schedule, apply a hardening baseline that turns off what isn't needed, keep users out of the local administrators group, and leave exploit protections such as Secure Boot, ASLR and Windows memory integrity turned on. Hardening is covered in the hardening section, and privilege escalation as an attack in the application attacks section.
On the exam, a scenario where a standard user gains root or SYSTEM through a flaw in the kernel or a built-in service describes an OS-based vulnerability, and patching the OS is the fix. If the flaw is in a service the system doesn't need, disabling that service is often the BEST answer.
VM escape breaks the isolation virtualization is supposed to provide
A hypervisor lets one physical server run many virtual machines, each with its own virtual hardware. Type 1 hypervisors, such as VMware ESXi, Microsoft Hyper-V, KVM and Xen, run directly on the hardware. Type 2 hypervisors, such as VirtualBox and VMware Workstation, run as applications on a host operating system, which adds that OS's vulnerabilities underneath every guest.
Virtualization promises isolation: a compromised VM should stay contained. VM escape breaks that promise. Code inside a guest exploits a flaw in the hypervisor, usually in the code that emulates virtual hardware, and runs on the host, where every other VM is within reach. VENOM (CVE-2015-3456) was a flaw in QEMU's virtual floppy disk controller, code used by KVM and Xen. In March 2025 VMware patched three ESXi flaws that were already being exploited; together they let an attacker with administrator rights inside a VM run code on the hypervisor.
In a public cloud, a VM escape would cross from one customer to another, so providers patch hypervisors quickly. In your own data center, hypervisor patching is your job, and it tends to lag. Patching a host means moving its VMs elsewhere with live migration or scheduling downtime, so hosts often run old builds long after their guests are current.
To harden hypervisors:
- Patch hypervisors and their management servers, such as vCenter, as promptly as the guests.
- Keep management interfaces on an isolated management network, never on the internet. ESXiArgs hit hosts whose services were reachable from anywhere.
- Disable host services that aren't needed. VMware's workaround for the flaw ESXiArgs targeted was simply to turn off the SLP service.
- Remove virtual hardware a VM doesn't use, such as floppy, serial and USB controllers, because each emulated device is code an attacker in the guest can reach.
- Treat hypervisor administrators as the most privileged admins you have, since control of a host means control of every VM on it.
Containers isolate less than VMs. Every container on a host shares the host's kernel, so a kernel flaw can become a container escape.