CVE-2025-41244: Broadcom VMware Aria Operations and VMware Tools privilege escalation

CVE-2025-41244 · Severity: critical · CVSS 7.8 · Exploited in the wild · Published 2025-10-30

A security vulnerability exists in VMware Aria Operations and VMware Tools, which are used to manage and optimize virtual machine performance. A user with limited access to a virtual machine can exploit this flaw to gain full administrative (root) control over that specific system. This could allow an attacker to steal sensitive data, disrupt services, or install malicious software on the affected virtual machine.

Vendors: Broadcom, VMware.

Quick answers

Is CVE-2025-41244 exploited in the wild?
Yes. CVE-2025-41244 is known to be exploited in the wild, first recorded on 30 October 2025. Treat it as urgent.
How severe is CVE-2025-41244?
Critical severity, with a CVSS score of 7.8, published 30 October 2025.
Which products and versions are affected?
VMware Open-Vm-Tools 11.2.0 to 12.5.4, 13.0.0.
Is there a fix for CVE-2025-41244?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-41244 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2025-41244?
Check whether you run Broadcom VMware Aria Operations, Broadcom VMware Tools or VMware Open-Vm-Tools at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A local privilege escalation vulnerability (CWE-267) exists in VMware Aria Operations and VMware Tools when Service Discovery Management Pack (SDMP) is enabled. The flaw stems from a privilege defined with unsafe actions, allowing a non-administrative local actor with access to a managed virtual machine to escalate their privileges to root. The attack requires the VM to have VMware Tools installed and be managed by Aria Operations with SDMP active. This vulnerability has been observed being exploited in the wild. Patches are available in Aria Operations 8.18.5 and VMware Tools 12.5.4 / 13.0.5.

Affected products

  • Broadcom VMware Aria Operations 8.0 to 8.18.5
  • Broadcom VMware VMware Tools 12.5.0 to 12.5.4, 13.0.0.0 to 13.0.5.0
  • Broadcom VMware open-vm-tools 11.2.0 to 12.5.4, 13.0.0

Timeline

  • 2025-10-30: advisory: Initial advisory published by Broadcom/VMware
  • 2025-10-30: kev added: Added to CISA Known Exploited Vulnerabilities catalog
  • 2025-10-30: exploited: Confirmed as exploited in the wild per CISA KEV catalog

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.