CVE-2025-41244

Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions

7.8 HIGHActively exploited (CISA KEV)Public exploitEPSS 8.44%

Published29 Sept 2025
Added to CISA KEV30 Oct 2025
Remediation due20 Nov 2025

Description

VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.

CVSS 3.1 breakdown

Attack vectorLocal

Attack complexityLow

Privileges requiredLow

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

VMware Aria Operations≥ 8.0 < 8.18.5

VMware Cloud Foundation≥ 4.0 ≤ 5.2.2

VMware Cloud Foundation Operations9.0

VMware Open Vm Tools≥ 11.2.0 < 12.5.4 · 13.0.0

VMware Telco Cloud Infrastructure≥ 2.2 ≤ 3.0

VMware Telco Cloud Platform≥ 4.0 < 5.0.1

VMware Tools≥ 12.5.0 < 12.5.4 · ≥ 13.0.0.0 < 13.0.5.0

Debian Linux11.0

Remediation

Fixed in

VMware Aria Operations≥ 8.18.5

VMware Open Vm Tools≥ 12.5.4

VMware Telco Cloud Platform≥ 5.0.1

VMware Tools≥ 12.5.4

Patch & vendor advisories

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36149

References

https://blog.nviso.eu/2025/09/29/you-name-it-vmware-elevates-it-cve-2025-41244/ExploitThird Party Advisory
https://lists.debian.org/debian-lts-announce/2025/10/msg00000.htmlMailing ListThird Party Advisory
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36149Vendor Advisory
http://support.broadcom.com/group/ecx/support-content-view/-/support-content/Security%20Advisories/VMSA-2025-0015--VMware-Aria-Operations-and-VMware-Tools-updates-address-multiple-vulnerabilities--CVE-2025-41244-CVE-2025-41245--CVE-2025-41246-/36149Permissions Required
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-41244US Government Resource
http://www.openwall.com/lists/oss-security/2025/09/29/10Mailing ListThird Party Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2025-41244 being actively exploited?

Yes. CVE-2025-41244 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 30 Oct 2025.

How severe is CVE-2025-41244?

CVE-2025-41244 has a CVSS 3.1 base score of 7.8, rated high. EPSS estimates a 8.44% probability of exploitation.

Which products are affected by CVE-2025-41244?

Affected products include VMware Aria Operations, VMware Cloud Foundation, VMware Cloud Foundation Operations, VMware Open Vm Tools, VMware Telco Cloud Infrastructure, and 3 more.

How do I fix CVE-2025-41244?

Upgrade affected software to a fixed version, for example VMware Aria Operations 8.18.5, VMware Open Vm Tools 12.5.4, VMware Telco Cloud Platform 5.0.1 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2025-41244 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.