CVE-2025-41244

CISA KEV

ACT NOW Priority: 0.00 BB Relevance: 2/100

Published: N/A Modified: N/A First seen: 2026-10-29 Status: pending_score

Description

Broadcom VMware Aria Operations and VMware Tools contain a privilege defined with unsafe actions vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.

CISA Known Exploited Vulnerability

Vendor / Product Broadcom — VMware Aria Operations and VMware Tools

Date Added 2025-10-30

Remediation Due 2025-11-20

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36149 ; https://nvd.nist.gov/vuln/detail/CVE-2025-41244

Weakness Classification (1)

CWE-267

Affected Software (10)

Vendor	Product	Version
debian	debian_linux	11.0
vmware	aria_operations	8.0 – 8.18.5
vmware	cloud_foundation	4.0 – 5.2.2
vmware	cloud_foundation_operations	9.0
vmware	open_vm_tools	11.2.0 – 12.5.4
vmware	open_vm_tools	13.0.0
vmware	telco_cloud_infrastructure	2.2 – 3.0
vmware	telco_cloud_platform	4.0 – 5.0.1
vmware	tools	12.5.0 – 12.5.4
vmware	tools	13.0.0.0 – 13.0.5.0