High severity · published Sep 29, 2025
CVE-2025-41244
VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246)
In wildKEV
7.8
CVSS
8.6%
EPSS
Yes
On KEV
Description
VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)8.6% · higher than 95% of CVEs
Exploited in the wildYes
CISA KEVListed Oct 30, 2025
Federal remediation dueNov 20, 2025
Ransomware campaign useNot known
Affected products
Which versions
VO
VCF operations · VMware
9.0.x before 9.0.1.0 · source: vendor
VA
VMware Aria Operations · VMware
8.18.x before 8.18.5 · source: vendor
VC
VMware Cloud Foundation · VMware
5.x before 8.18.5; 4.x before 8.18.5 · source: vendor
VT
VMware Telco Cloud Infrastructure · VMware
3.x before 8.18.5; 2.x before 8.18.5 · source: vendor
VT
VMware Telco Cloud Platform · VMware
5.x before 8.18.5; 4.x before 8.18.5 · source: vendor
VT
VMware tools · VMware
13.x.x.x before 13.0.5.0; 12.5.x before 12.5.4 · source: vendor
AO
Aria Operations · Vmware
8.0 before 8.18.5 · source: NVD
CF
Cloud Foundation · Vmware
4.0 through 5.2.2 · source: NVD
CF
Cloud Foundation Operations · Vmware
9.0 · source: NVD
DL
Debian Linux · Debian
11.0 · source: NVD
OV
Open VM Tools · Vmware
11.2.0 before 12.5.4; 13.0.0 · source: NVD
TC
Telco Cloud Infrastructure · Vmware
2.2 through 3.0 · source: NVD
In the news
VulnerabilityHigh
[CISA KEV] CVE-2025-41244: Broadcom VMware Aria Operations and VMware Tools - Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability
Broadcom VMware Aria Operations and VMware Tools contain a privilege defined with unsafe actions vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.
VAVMware Aria Operations and VMware ToolsCVE-2025-41244
Oct 30, 2025·CISA KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-41244
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-41244
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
support.broadcom.com
http://support.broadcom.com/group/ecx/support-content-view/-/support-content/Security%20Advisories/VMSA-2025-0015--VMware-Aria-Operations-and-VMware-Tools-updates-address-multiple-vulnerabilities--CVE-2025-41244-CVE-2025-41245--CVE-2025-41246-/36149
More from VCF operations
8.0
CVE-2026-41723
VMSA-2026-0004: VMware Cloud Foundation Operations updates address multiple vulnerabilities (CVE-2026-41722, CVE-2026-41723 and CVE-2026-41724)
5.4
CVE-2026-41724
VMSA-2026-0004: VMware Cloud Foundation Operations updates address multiple vulnerabilities (CVE-2026-41722, CVE-2026-41723 and CVE-2026-41724)
5.4
CVE-2026-41722
VMSA-2026-0004: VMware Cloud Foundation Operations updates address multiple vulnerabilities (CVE-2026-41722, CVE-2026-41723 and CVE-2026-41724)