VULNERABILITY INTELLIGENCE

CVE-2025-41244

CVSS score7.8 HIGH
EPSS probability8.63%
CISA KEVKnown exploited vulnerability
Published2025-09-29
Last modified2026-10-18
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Known Exploited Vulnerability

Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability

Vendor / product: Broadcom / VMware Aria Operations and VMware Tools

Description

VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.

Weakness classification

  • security@vmware.com: CWE-267

Primary references