Skip to content

CVE · Exploited · On CISA KEV

CVE-2025-41244

Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability

7.8
CVSS 3.1
1
story
OCT 30
added to KEV
Severity
7.8 High · vendor score
Vendor
Broadcom
Product
VMware Aria Operations and VMware Tools
Published
Sep 29, 2025
Added to KEV
Oct 30, 2025
KEV deadline
Nov 20, 2025
Ransomware use
Unknown
Weakness
CWE-267

What it is

Broadcom VMware Aria Operations and VMware Tools contain a privilege defined with unsafe actions vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.

From CISA's Known Exploited Vulnerabilities catalog

Decipher coverage · 1 story

Newest first ↑
  1. VMware Patches Bug Exploited By State ActorsThe vulnerability (CVE-2025-41244) is easily exploitable, although it requires existing privileges on the target product.DENNIS FISHER · 2 MIN

Official references

7 sources

Registries

RegistryNVDScore, weakness and every referenceRegistryCVE.orgThe official CVE recordRegistryCISA KEVKnown exploited, with the federal deadline

Advisories, fixes & analysis

Vendor advisorysupport.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36149Analysisopenwall.com/lists/oss-security/2025/09/29/10Analysislists.debian.org/debian-lts-announce/2025/10/msg00000.htmlExploitblog.nviso.eu/2025/09/29/you-name-it-vmware-elevates-it-cve-2025-41244