7.8
Élevée
Exploitée
CVE-2025-41244 Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability
Exploitation active constatée
· catalogue CISA KEV
Action attendue
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Campagnes de rançongiciel
Non constatée à ce jour
Faiblesse
CWE-267
Description
VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| VCF operations 9.0 | 9.0.x → < 9.0.1.0 | 9.0.1.0 |
| VMware Tools 13 | 13.x.x.x → < 13.0.5.0 | 13.0.5.0 |
| VMware Tools 12.5 | 12.5.x → < 12.5.4 | 12.5.4 |
| VMware Aria Operations 8.18 | 8.18.x → < 8.18.5 | 8.18.5 |
| VMware Cloud Foundation 5 | 5.x → < 8.18.5 | 8.18.5 |
| VMware Cloud Foundation 4 | 4.x → < 8.18.5 | 8.18.5 |
| VMware Telco Cloud Platform 5 | 5.x → < 8.18.5 | 8.18.5 |
| VMware Telco Cloud Platform 4 | 4.x → < 8.18.5 | 8.18.5 |
| VMware Telco Cloud Infrastructure 3 | 3.x → < 8.18.5 | 8.18.5 |
Afficher l’autre branche Masquer l’autre branche
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| VMware Telco Cloud Infrastructure 2 | 2.x → < 8.18.5 | 8.18.5 |
Références
- support.broadcom.com support.broadcom.com
Chronologie
- Publiée
- Ajoutée au catalogue KEV
- Dernière modification
Autres CVE de VCF operations
Les 4 CVE de VCF operations →
CVE-2026-41724
VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor…
8.0
Élevée
CVE-2026-41723
VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor…
8.0
Élevée
CVE-2026-41722
VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor…
8.0
Élevée