---
title: "CVE-2025-41244: Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability"
url: https://erroneo.us/security/cve/CVE-2025-41244/
description: "CVE-2025-41244 (Broadcom VMware Aria Operations and VMware Tools): Exploited in the wild (CISA KEV). VMware Aria Operations and VMware Tools contain a local…"
type: vulnerability-record
section: "Security Digest"
date_published: 2025-09-29
date_modified: 2026-02-26
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2025-41244"
kev: true
cvss: 7.8
epss: 0.08629
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2025-41244: Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability

**Signal:** Exploited: patch now if you run it. CISA has confirmed exploitation in the wild. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- Yes, if you run Broadcom VMware Aria Operations and VMware Tools. CISA added this CVE to its Known Exploited Vulnerabilities catalog on 2025-10-30, which means there is reliable evidence of exploitation in the wild. US federal agencies must remediate by 2025-11-20 ; treat that as the outer limit, not the target.
- EPSS 8.6% , percentile 95: FIRST’s model estimates a 8.6% chance of exploitation activity in the next 30 days, higher than 95% of all scored CVEs (very high). EPSS is a probability, not a verdict.
- Needs local access needed. Lower urgency for most teams unless an attacker could already run code on the machine.

## What it is

VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.

## Affected products (CVE record)

- VMware VCF operations: 9.0.x < 9.0.1.0
- VMware VMware tools: 13.x.x.x < 13.0.5.0, 12.5.x < 12.5.4
- VMware VMware Aria Operations: 8.18.x < 8.18.5
- VMware VMware Cloud Foundation: 5.x < 8.18.5, 4.x < 8.18.5
- VMware VMware Telco Cloud Platform: 5.x < 8.18.5, 4.x < 8.18.5
- VMware VMware Telco Cloud Infrastructure: 3.x < 8.18.5, 2.x < 8.18.5

## Severity

- vmware CVSS 3.1: 7.8 `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`

## Exploitation

- CISA KEV: added 2025-10-30; federal due date 2025-11-20. Known ransomware use: Unknown.
- CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CISA SSVC assessment: exploitation active , automatable no , technical impact total .
- FIRST EPSS (model of 2026-10-21): 8.63% probability of exploitation activity in the next 30 days; percentile 95.

## Sources

- [support.broadcom.com](https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36149)
- [CVE.org record CVE-2025-41244](https://www.cve.org/CVERecord?id=CVE-2025-41244)
- [NVD entry CVE-2025-41244](https://nvd.nist.gov/vuln/detail/CVE-2025-41244)
- [CISA Known Exploited Vulnerabilities catalog entry](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-41244)
- [support.broadcom.com](http://support.broadcom.com/group/ecx/support-content-view/-/support-content/Security%20Advisories/VMSA-2025-0015--VMware-Aria-Operations-and-VMware-Tools-updates-address-multiple-vulnerabilities--CVE-2025-41244-CVE-2025-41245--CVE-2025-41246-/36149)
- [blog.nviso.eu](https://blog.nviso.eu/2025/09/29/you-name-it-vmware-elevates-it-cve-2025-41244/)
- [lists.debian.org](https://lists.debian.org/debian-lts-announce/2025/10/msg00000.html)
- [openwall.com](http://www.openwall.com/lists/oss-security/2025/09/29/10)

---
Source page: https://erroneo.us/security/cve/CVE-2025-41244/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt