Broadcom · VMware Aria Operations and VMware Tools
CVE-2025-41244
VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246)
What it is
VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.
CISA: Broadcom VMware Aria Operations and VMware Tools contain a privilege defined with unsafe actions vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.
What to do
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: November 20, 2025
More exploited flaws from Broadcom
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Aug 18, 2026 | Path Traversal | VMware vCenter | Critical 9.8 | 2.6% |
| Mar 3, 2026 | Command Injection | VMware Aria Operations | High 8.1 | 18% |
| Jan 23, 2026 | Out-of-bounds Write | VMware vCenter Server | Critical 9.8 | 22% |
| Apr 28, 2025 | Code Injection | Brocade Fabric OS | High 8.6 | 0.7% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.