NetSight
IP …
high7.8Known exploited

CVE-2025-41244

Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability

Exploited in the wild

This vulnerability is on the CISA Known Exploited Vulnerabilities list, added 2025-10-30. Federal due date: 2025-11-20.

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Impact

Broadcom VMware Aria Operations and VMware Tools contain a privilege defined with unsafe actions vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.

Affected products

VendorProductAffected versions
VmwareAria Operations
from 8.0 before 8.18.5
VmwareCloud Foundation
from 4.0 through 5.2.2
VmwareCloud Foundation Operations
Version 9.0
VmwareOpen Vm Tools
from 11.2.0 before 12.5.4
Version 13.0.0
VmwareTelco Cloud Infrastructure
from 2.2 through 3.0
VmwareTelco Cloud Platform
from 4.0 before 5.0.1
DebianDebian Linux
Version 11.0
VmwareTools
from 12.5.0 before 12.5.4
from 13.0.0.0 before 13.0.5.0

Weakness classification

CWE-267

References