← Vulnerability Intelligence

CVE-2025-41244

High 7.8 Exploited in the wild (KEV)

Confirmed active exploitation — CISA KEV catalog

Name
Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability
Added to catalog
Remediation due date (US federal)
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Description

VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.

Metrics

CVSS 3.1
7.8 (HIGH) Score source: CNA CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS — exploit probability
9% (percentile: 95) as of 1 November 2026
CWE
CWE-267

Affected products

vmware: aria operations; vmware: cloud foundation; vmware: cloud foundation operations; vmware: open vm tools; vmware: telco cloud infrastructure; vmware: telco cloud platform; debian: debian linux; vmware: tools; linux: linux kernel; microsoft: windows

References