{"id":"CVE-2025-41244","kind":"vulnerability","aliases":["CVE-2025-41244"],"related":[],"title":"VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability","description":"Broadcom VMware Aria Operations and VMware Tools contain a privilege defined with unsafe actions vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"A local user with non-admin access on a VM running VMware Tools managed by Aria Operations with SDMP enabled can escalate to root on that same VM. CISA lists it as actively exploited in the wild.","severity":"high","cvss":7.8,"epss":null,"exploited":true,"exploited_at":"2025-10-30T00:00:00+00:00","products":[{"name":"Broadcom VMware Aria Operations and VMware Tools","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"vmware aria operations","fixed":["8.18.5"],"affected":">= 8.0, < 8.18.5","ecosystem":"vendor"},{"name":"vmware cloud foundation","fixed":[],"affected":">= 4.0, <= 5.2.2","ecosystem":"vendor"},{"name":"vmware cloud foundation operations","fixed":[],"affected":"= 9.0","ecosystem":"vendor"},{"name":"vmware open vm tools","fixed":["12.5.4"],"affected":">= 11.2.0, < 12.5.4","ecosystem":"vendor"},{"name":"vmware open vm tools","fixed":[],"affected":"= 13.0.0","ecosystem":"vendor"},{"name":"vmware telco cloud infrastructure","fixed":[],"affected":">= 2.2, <= 3.0","ecosystem":"vendor"},{"name":"vmware telco cloud platform","fixed":["5.0.1"],"affected":">= 4.0, < 5.0.1","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 11.0","ecosystem":"vendor"},{"name":"vmware tools","fixed":["12.5.4"],"affected":">= 12.5.0, < 12.5.4","ecosystem":"vendor"},{"name":"vmware tools","fixed":["13.0.5.0"],"affected":">= 13.0.0.0, < 13.0.5.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","vendor","vmware","vmware-aria-operations","vmware-tools"],"not_affected_if":["no-aria-operations-management","sdmp-disabled"],"how_to_check":"Check whether Aria Operations is managing the VM and whether SDMP is enabled in Aria Operations; the sources do not give a command or file path for this.","fix":"Apply the vendor mitigation or patch from Broadcom's advisory for VMware Aria Operations and VMware Tools; the sources do not name the fixed version.\nIf mitigations are unavailable, CISA says discontinue use of the product.","status":"open","published_at":"2025-09-29T17:15:30+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:44:24+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-23T20:44:24Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigation or patch from Broadcom's advisory for VMware Aria Operations and VMware Tools; the sources do not name the fixed version.\nIf mitigations are unavailable, CISA says discontinue use of the product.","reach":"local","summary":"A local user with non-admin access on a VM running VMware Tools managed by Aria Operations with SDMP enabled can escalate to root on that same VM. CISA lists it as actively exploited in the wild.","category":"vendor","who_cares":["vmware-aria-operations","vmware-tools","vmware"],"confidence":0.7,"needs_auth":"yes","worst_case":"Local non-admin user gains root on the affected VM.","analyst_note":"Find the Broadcom advisory for CVE-2025-41244 to get affected and fixed versions and the SDMP mitigation steps; the sources do not provide them.","how_to_check":"Check whether Aria Operations is managing the VM and whether SDMP is enabled in Aria Operations; the sources do not give a command or file path for this.\nunknown\nunknown","needs_analyst":true,"not_affected_if":["sdmp-disabled","no-aria-operations-management"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000487,"input_tokens":2640,"output_tokens":447,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':172C '-2025':14A,17A '-41244':15A,18A '22':171C 'access':75B,131C 'action':119C,162C 'activ':101B 'actor':124C 'admin':74B 'administr':128C 'and':23A 'appli':163C 'applic':169C 'aria':2A,21A,27A,63B,84B,108C,142C 'bod':170C 'broadcom':19A,106C 'cisa':97B,160C 'cloud':30A,33A,46A,50A,175C 'contain':7A,113C 'cve':13A,16A 'debian':52A 'defin':116C 'discontinu':178C 'enabl':88B,146C 'escal':11A,90B,152C 'exploit':58B,102B,148C 'follow':168C 'foundation':31A,34A 'guidanc':173C 'infrastructure':47A 'instal':138C 'instruct':167C 'linux':53A 'list':98B 'local':9A,69B,123C 'malici':122C 'manag':82B,140C 'may':147C 'mitig':164C,184C 'non':73B,127C 'non-admin':72B 'non-administr':126C 'open':37A,41A 'oper':3A,64B,85B,109C,143C 'operations':22A,28A,35A 'per':165C 'platform':51A 'privileg':10A,115C,129C,153C 'product':182C 'requir':161C 'root':92B,155C 'run':79B 'sdmp':87B,145C 'servic':176C 'telco':45A,49A 'tool':6A,67B,81B,112C,137C 'tools':25A,39A,43A,55A,57A 'unavail':186C 'unsaf':118C 'use':179C 'user':70B 'vendor':59B,166C 'vm':38A,42A,78B,96B,134C,159C 'vmware':1A,5A,20A,24A,26A,29A,32A,36A,40A,44A,48A,54A,56A,60B,62B,66B,80B,107C,111C,136C 'vmware-aria-oper':61B 'vmware-tool':65B 'vulner':12A,120C,150C 'wild':105B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-09-29T17:15:30+00:00","kev":{"dateAdded":"2025-10-30","dueDate":"2025-11-20","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@vmware.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2025-41244","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-41244","severity":null,"published_at":"2025-10-30T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T11:39:14+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-41244","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-41244","severity":null,"published_at":"2025-09-29T17:15:30+00:00","modified_at":"2026-10-18T21:10:00+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}