CVE-2025-41244

7.8

HIGH CVSS 3.1

Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability - [Actively Exploited]

Description

VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.

INFO

Published Date :

Sept. 29, 2025, 5:15 p.m.

Last Modified :

Nov. 6, 2025, 1:58 p.m.

Remotely Exploit :

No

Source :

[email protected]

CISA Notification

CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Due Date: Nov 20, 2025 | 13 days left

Alert Date: Oct 30, 2025 | 7 days ago

Description :

Broadcom VMware Aria Operations and VMware Tools contain a privilege defined with unsafe actions vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.

Required Action :

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes :

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36149 ; https://nvd.nist.gov/vuln/detail/CVE-2025-41244

Affected Products

The following products are affected by CVE-2025-41244 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product
1	Vmware	tools
2	Vmware	cloud_foundation
3	Vmware	open_vm_tools
4	Vmware	aria_operations
5	Vmware	telco_cloud_platform
6	Vmware	telco_cloud_infrastructure
7	Vmware	cloud_foundation_operations
1	Linux	linux_kernel
1	Debian	debian_linux
1	Microsoft	windows

: Total Affected Vendor : 4 | Products : 10

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Score	Version	Severity	Vector	Exploitability Score	Impact Score	Source
	CVSS 3.1	HIGH				dcf2e128-44bd-42ed-91e8-88f912c1401d
	CVSS 3.1	HIGH				[email protected]

Solution

Update VMware Aria Operations and VMware Tools to fix privilege escalation.

Update VMware Aria Operations.
Update VMware Tools.
Apply vendor patches when available.

Public PoC/Exploit Available at Github

CVE-2025-41244 has a 7 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2025-41244.

URL	Resource
http://support.broadcom.com/group/ecx/support-content-view/-/support-content/Security%20Advisories/VMSA-2025-0015--VMware-Aria-Operations-and-VMware-Tools-updates-address-multiple-vulnerabilities--CVE-2025-41244-CVE-2025-41245--CVE-2025-41246-/36149	Permissions Required
http://www.openwall.com/lists/oss-security/2025/09/29/10	Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2025/10/msg00000.html	Mailing List Third Party Advisory
https://blog.nviso.eu/2025/09/29/you-name-it-vmware-elevates-it-cve-2025-41244/	Exploit Third Party Advisory
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36149	Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-41244	US Government Resource

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2025-41244 is associated with the following CWEs:

CWE-267: Privilege Defined With Unsafe Actions

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2025-41244 weaknesses.

CAPEC-58: Restful Privilege Elevation Restful Privilege Elevation CAPEC-634: Probe Audio and Video Peripherals Probe Audio and Video Peripherals CAPEC-637: Collect Data from Clipboard Collect Data from Clipboard CAPEC-643: Identify Shared Files/Directories on System Identify Shared Files/Directories on System CAPEC-648: Collect Data from Screen Capture Collect Data from Screen Capture

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Newkoncept/HNG-3-Build-Integrate-AI-Agent

None

Python

Updated: 16 hours, 5 minutes ago

0 stars 0 fork 0 watcher

Born at : Nov. 2, 2025, 4:21 a.m. This repo has been linked 1 different CVEs too.

haspiranti/CVE-2025-41244-PoC

VMware Aria Operations < 4.18.5 & VMware Tools - Local Privilege Escalation

Updated: 1 month ago

0 stars 0 fork 0 watcher

Born at : Oct. 6, 2025, 1:35 a.m. This repo has been linked 1 different CVEs too.

rxerium/CVE-2025-41244

Detection for CVE-2025-41244

nuclei aria-operations vulnerability zero-day

Updated: 3 weeks, 2 days ago

1 stars 0 fork 0 watcher

Born at : Sept. 30, 2025, 11:40 a.m. This repo has been linked 1 different CVEs too.

kenkang99/navernews_github_action

네이버뉴스 가져오기

Python

Updated: 4 days, 14 hours ago

0 stars 0 fork 0 watcher

Born at : Aug. 6, 2025, 2:43 a.m. This repo has been linked 1 different CVEs too.

DevGreick/devgreick

None

Python

Updated: 14 hours, 14 minutes ago

1 stars 0 fork 0 watcher

Born at : Oct. 29, 2024, 8:10 p.m. This repo has been linked 10 different CVEs too.

rxerium/stars

A list of all of my starred repos, automated using Github Actions 🌟

github-actions stars

Updated: 5 days, 18 hours ago

0 stars 0 fork 0 watcher

Born at : Jan. 4, 2023, 11:20 a.m. This repo has been linked 30 different CVEs too.

nomi-sec/PoC-in-GitHub

📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.

security cve exploit poc vulnerability

Updated: 13 hours, 44 minutes ago

7367 stars 1216 fork 1216 watcher

Born at : Dec. 8, 2019, 1:03 p.m. This repo has been linked 828 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2025-41244 vulnerability anywhere in the article.

europa.eu

Cyber Brief 25-11 - October 2025

Cyber Brief (October 2025)November 3, 2025 - Version: 1TLP:CLEARExecutive summaryWe analysed 281 open source reports for this Cyber Brief1.Relating to cyber policy and law enforcement, the European Co ...

Published Date: Nov 01, 2025 (5 days, 4 hours ago)

security.nl

Amerikaanse overheid bevestigt actief misbruik van VMware-lek

Aanvallers maken actief misbruik van een kwetsbaarheid in VMware Aria Operations en VMware Tools waarvoor vorige maand een beveiligingsupdate verscheen, zo meldt het Amerikaanse cyberagentschap CISA. ...

Published Date: Oct 31, 2025 (6 days, 10 hours ago)

The Hacker News

CISA Flags VMware Zero-Day Exploited by China-Linked Hackers in Active Attacks

Oct 31, 2025Ravie LakshmananVulnerability / Cyber Attack The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a high-severity security flaw impacting Broadcom VMware To ...

Published Date: Oct 31, 2025 (6 days, 13 hours ago)

Daily CyberSecurity

CISA Warns of Active Exploitation in XWiki and VMware Vulnerabilities

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two new flaws—CVE-2025-24893 in XWiki Platform and CVE-2025-41244 in Broadcom VMware Aria Operations and VMware Tools—to its ...

Published Date: Oct 31, 2025 (6 days, 18 hours ago)

CybersecurityNews

CISA Warns of VMware Tools and Aria Operations 0-Day Vulnerability Exploited in Attacks

The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-41244 to its Known Exploited Vulnerabilities catalog. This local privilege escalation flaw affects Broadcom’s VMware Aria ...

Published Date: Oct 31, 2025 (6 days, 19 hours ago)

TheCyberThrone

CISA Adds Dassault DELMIA, XWiki, and VMware Aria Bugs to KEV Catalog

The Cybersecurity and Infrastructure Security Agency (CISA) has recently updated its Known Exploited Vulnerabilities (KEV) catalog with significant new entries affecting enterprise and open-source sof ...

Published Date: Oct 31, 2025 (6 days, 19 hours ago)

BleepingComputer

CISA orders feds to patch VMware Tools flaw exploited by Chinese hackers

On Thursday, CISA warned U.S. government agencies to secure their systems against attacks exploiting a high-severity vulnerability in Broadcom's VMware Aria Operations and VMware Tools software. Track ...

Published Date: Oct 30, 2025 (1 week ago)

The Cyber Express

Critical Zero-Day in Oracle E-Business Suite Prompts Urgent Security Updates

Oracle has issued a security alert warning users of a zero-day vulnerability in its widely used Oracle E-Business Suite. Tracked as CVE-2025-61882, this flaw allows unauthenticated, remote attackers t ...

Published Date: Oct 06, 2025 (1 month ago)

The Cyber Express

Unity Warns Developers of Security Vulnerability Affecting Games on Android, Windows, and Linux Platforms

A recently disclosed security vulnerability in Unity has prompted security updates and, in some cases, game removals across platforms like Steam. The issue affects Unity versions 2017.1 and later, spa ...

Published Date: Oct 06, 2025 (1 month ago)

The Cyber Express

Critical Splunk Vulnerabilities Expose Platforms to Remote JavaScript Injection and More

Splunk has disclosed six critical security vulnerabilities impacting multiple versions of both Splunk Enterprise and Splunk Cloud Platform. These Splunk vulnerabilities, collectively highlighting seri ...

Published Date: Oct 03, 2025 (1 month ago)

The Cyber Express

Japan’s Beer Taps Fear Running Dry as Cyberattack on Asahi Disrupts Production

Japan’s largest brewery, Asahi Group Holdings, is racing against time as it struggles to recover from a cyberattack that has severely disrupted its operations. The Asahi cyberattack, which was first r ...

Published Date: Oct 03, 2025 (1 month ago)

The Cyber Express

Your Easiest Fix: The 3 Golden Rules for a Password that AI Can’t Crack

October is here, and Cybersecurity Awareness Month 2025 is about to come into being. Department of Homeland Security (DHS) and CISA have initiated this year’s campaign with the theme of ‘Building our ...

Published Date: Oct 03, 2025 (1 month ago)

The Cyber Express

Hackers Claim Breach of Red Hat Customer Data

Hackers claim to have breached a Red Hat GitHub instance and stolen sensitive customer data. The claims were made in Telegram posts by a group calling itself “Crimson Collective,” which said it exfilt ...

Published Date: Oct 02, 2025 (1 month ago)

The Cyber Express

New VMware Vulnerability CVE-2025-41244 Actively Exploited Since October 2024

A newly listed VMware zero-day vulnerability has been actively exploited by Chinese state-sponsored threat actors for almost a year, according to security researchers. The vulnerability, CVE-2025-4124 ...