CVE-2025-41244
VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246)
KEVHIGH 7.8EPSS 8.4%
VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.
- Affected
- VMware · VCF operations · VMware tools · VMware Aria Operations · VMware Cloud Foundation · VMware Telco Cloud Platform · VMware Telco Cloud Infrastructure
- CVSS v3.1 VMWARE
- 7.8 HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - EPSS
- 8.44% chance of exploitation in the next 30 days, 95th percentile
- CISA KEV
- added 2025-10-30
- Published
- 2025-09-29
- Updated
- 2026-02-26
Proof-of-concept exploits (2)
- NULL200OK/CVE-2025-412442★ · 2025-11-11
- haspiranti/CVE-2025-41244-PoC0★ · 2025-10-06
Security advisories
- https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/Secu…
- http://www.openwall.com/lists/oss-security/2025/09/29/10
- https://blog.nviso.eu/2025/09/29/you-name-it-vmware-elevates-it-cve-2025-41244
- https://lists.debian.org/debian-lts-announce/2025/10/msg00000.html