CVEs / CVE-2025-41244
CVE-2025-41244: Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability
- Known exploited in the CISA KEV catalog since 30 Oct 2025
- high 7.8 CVSS 3.1 (from the CNA)
- EPSS 8.62% chance of exploitation in the next 30 days, higher than 95% of CVEs (30 Oct 2026)
- Last changed at its sources
Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.
Check your servers with Stackurity Already using Stackurity? Search for CVE-2025-41244
Summary
Broadcom VMware Aria Operations and VMware Tools contain a privilege defined with unsafe actions vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.
Description
VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| VMware VCF operations | from 9.0.x, before 9.0.1.0 | 9.0.1.0 |
| VMware VMware tools | from 13.x.x.x, before 13.0.5.0 | 13.0.5.0 |
| VMware VMware tools | from 12.5.x, before 12.5.4 | 12.5.4 |
| VMware VMware Aria Operations | from 8.18.x, before 8.18.5 | 8.18.5 |
| VMware VMware Cloud Foundation | from 5.x, before 8.18.5 | 8.18.5 |
| VMware VMware Cloud Foundation | from 4.x, before 8.18.5 | 8.18.5 |
| VMware VMware Telco Cloud Platform | from 5.x, before 8.18.5 | 8.18.5 |
| VMware VMware Telco Cloud Platform | from 4.x, before 8.18.5 | 8.18.5 |
| VMware VMware Telco Cloud Infrastructure | from 3.x, before 8.18.5 | 8.18.5 |
| VMware VMware Telco Cloud Infrastructure | from 2.x, before 8.18.5 | 8.18.5 |
Exploitation
| In CISA KEV since | 30 Oct 2025 |
|---|---|
| Due date for US federal agencies | 20 Nov 2025 |
| Used in ransomware campaigns | Unknown |
| Required action | Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. |
Severity
| CVSS 3.1 | 7.8 highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HScored by the CNA ([email protected]) |
|---|---|
| Weakness | CWE-267 |
References
- CVE-2025-41244 on NVD
- CVE-2025-41244 in the CISA KEV catalog
- https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36149 (cited by CISA)
- CVE-2025-41244 on OSV
- http://support.broadcom.com/group/ecx/support-content-view/-/support-content/Security%20Advisories/VMSA-2025-0015--VMware-Aria-Operations-and-VMware-Tools-updates-address-multiple-vulnerabilities--CVE-2025-41244-CVE-2025-41245--CVE-2025-41246-/36149 Permissions Required
- http://www.openwall.com/lists/oss-security/2025/09/29/10 Mailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2025/10/msg00000.html Mailing List, Third Party Advisory
- https://blog.nviso.eu/2025/09/29/you-name-it-vmware-elevates-it-cve-2025-41244/ Exploit, Third Party Advisory
- https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36149 Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-41244 US Government Resource
Sources
Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.
This product uses data from the NVD API but is not endorsed or certified by the NVD.