Skip to content
Sign in
7.8 High

CVE-2025-41244 Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability

Active exploitation observed

· CISA KEV catalogue
Required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Ransomware campaigns Not observed so far
Weakness CWE-267

Description

VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.

Affected products and versions

Product Affected versions Fixed in
VCF operations 9.0 9.0.x → < 9.0.1.0 9.0.1.0
VMware Tools 13 13.x.x.x → < 13.0.5.0 13.0.5.0
VMware Tools 12.5 12.5.x → < 12.5.4 12.5.4
VMware Aria Operations 8.18 8.18.x → < 8.18.5 8.18.5
VMware Cloud Foundation 5 5.x → < 8.18.5 8.18.5
VMware Cloud Foundation 4 4.x → < 8.18.5 8.18.5
VMware Telco Cloud Platform 5 5.x → < 8.18.5 8.18.5
VMware Telco Cloud Platform 4 4.x → < 8.18.5 8.18.5
VMware Telco Cloud Infrastructure 3 3.x → < 8.18.5 8.18.5
Show the other branch
Product Affected versions Fixed in
VMware Telco Cloud Infrastructure 2 2.x → < 8.18.5 8.18.5

Other CVEs of VCF operations

The 4 CVEs of VCF operations →
CVE-2026-41724 VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor… 8.0 High CVE-2026-41723 VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor… 8.0 High CVE-2026-41722 VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor… 8.0 High
Track this CVE