CVE-2025-41244
Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability
Description
CVE-2025-41244 is a high-severity local privilege escalation vulnerability in VMware Aria Operations and VMware Tools, rated at CVSS v3.1 score of 7.8. The flaw allows a non-administrative local user with access to a virtual machine that has VMware Tools installed and is managed by Aria Operations with SDMP enabled to escalate privileges to root. This vulnerability has been added to CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of November 20, 2025. The EPSS score of 0.00786 (73.5th percentile) indicates moderate exploitation probability, with a public exploit published by NVISO.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| vmware | aria operations | >= 8.0, < 8.18.5 |
| vmware | cloud foundation | >= 4.0, <= 5.2.2 |
| vmware | cloud foundation operations | 9.0 |
| vmware | open vm tools | >= 11.2.0, < 12.5.4; 13.0.0 |
| vmware | telco cloud infrastructure | >= 2.2, <= 3.0 |
| vmware | telco cloud platform | >= 4.0, < 5.0.1 |
| debian | debian linux | 11.0 |
| vmware | tools | >= 12.5.0, < 12.5.4; >= 13.0.0.0, < 13.0.5.0 |
References
- http://support.broadcom.com/group/ecx/support-content-view/-/support-content/Security%20Advisories/VMSA-2025-0015--VMware-Aria-Operations-and-VMware-Tools-updates-address-multiple-vulnerabilities--CVE-2025-41244-CVE-2025-41245--CVE-2025-41246-/36149(Permissions Required)
- http://www.openwall.com/lists/oss-security/2025/09/29/10(Mailing List, Third Party Advisory)
- https://lists.debian.org/debian-lts-announce/2025/10/msg00000.html(Mailing List, Third Party Advisory)
- https://blog.nviso.eu/2025/09/29/you-name-it-vmware-elevates-it-cve-2025-41244/(Exploit, Third Party Advisory)
- https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36149(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-41244(US Government Resource)
Weakness Type
CWE-267: Privilege Defined With Unsafe Actions
CWE-267 occurs when a software system defines a privilege level or role that includes access to actions or operations that are inherently unsafe and should require higher authorization. In CVE-2025-41244, the VMware Tools SDMP (Service Discovery and Monitoring Protocol) component grants excessive privileges to certain operations that can be invoked by non-administrative users, allowing them to perform actions that should be restricted to root or administrator level.
Impact Analysis
The business impact of CVE-2025-41244 is significant in virtualized environments managed by VMware Aria Operations. Confidentiality, integrity, and availability are all rated as high impact because root-level access to a virtual machine allows an attacker to read all data on the VM, modify system configurations and installed software, and potentially disrupt services running on that VM.
The exploitation context requires several conditions to be met simultaneously: the target VM must have VMware Tools installed, the VM must be managed by Aria Operations, and the SDMP feature must be enabled. While these prerequisites narrow the vulnerable population, organizations using Aria Operations for infrastructure monitoring typically enable SDMP broadly across their managed VM fleet, meaning the affected scope within qualifying environments is substantial. The breadth of affected products is notable — the vulnerability spans VMware Aria Operations 8.x, VMware Cloud Foundation 4.x through 5.x, VMware Open VM Tools 11.2.0 through 13.0.0, VMware Telco Cloud Infrastructure, VMware Telco Cloud Platform, and Debian Linux packages of Open VM Tools. The EPSS score of 0.00786 (73.5th percentile) indicates moderate but active exploitation, consistent with the KEV listing. Ransomware association is listed as unknown, but privilege escalation to root within VMs in a managed environment could enable lateral movement through the virtualization infrastructure.
Exploit Maturity
CVE-2025-41244 is confirmed as actively exploited in the wild with a publicly available exploit. CISA KEV status: Added to the Known Exploited Vulnerabilities catalog with a mandatory remediation deadline of November 20, 2025. EPSS context: The score of 0.00786 (73.5th percentile) reflects moderate but confirmed exploitation activity.
Public exploit: NVISO has published a detailed technical blog post documenting the exploitation technique for this privilege escalation vulnerability. The blog provides sufficient technical detail to reproduce the exploit, lowering the barrier for additional threat actors. Vendor advisory: Broadcom has published the official security advisory VMSA-2025-0015 covering this and related VMware vulnerabilities. Ransomware association: Currently listed as unknown.
Remediation
-
Update VMware Tools and Open VM Tools — Upgrade VMware Tools to version 12.5.4 or later (for the 12.x branch) or 13.0.5 or later (for the 13.x branch). For systems using Open VM Tools from Linux distribution repositories, apply the latest package updates. Refer to the Broadcom security advisory VMSA-2025-0015 for the complete list of patched versions.
-
Update Aria Operations — Upgrade VMware Aria Operations to version 8.18.5 or later. For VMware Cloud Foundation environments, follow the specific patching guidance for your Cloud Foundation version (4.x through 5.2.2 are affected).
-
Disable SDMP if not required — As an interim mitigation, disable the Service Discovery and Monitoring Protocol (SDMP) feature in Aria Operations for VMs where it is not strictly necessary. This removes the specific code path that enables the privilege escalation.
-
Restrict VM local access — Reduce the number of users with interactive local access to VMs managed by Aria Operations. Implement role-based access controls to ensure only authorized administrators can log into these VMs.
-
Monitor for privilege escalation attempts — Deploy monitoring rules on managed VMs that detect unexpected transitions to root/SYSTEM privileges, particularly from user accounts that should not have administrative access. Review VM audit logs for suspicious SDMP-related activity.
Technical Details
The CVSS v3.1 vector for CVE-2025-41244 is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, producing a score of 7.8. Attack Vector (Local) means the attacker must have local access to the virtual machine — network-only access is insufficient. Attack Complexity (Low) indicates the exploitation is reliable once the prerequisites are met. Privileges Required (Low) confirms that a standard, non-administrative user account is sufficient. User Interaction (None) means no other user needs to perform any action.
The vulnerability resides in the interaction between VMware Tools' SDMP component and the Aria Operations management infrastructure. When SDMP is enabled on a managed VM, VMware Tools runs a service that collects system information and reports it to Aria Operations. This SDMP service defines certain privileged operations that can be influenced by local users through the VMware Tools communication channels. Due to the CWE-267 weakness — defining privileges with unsafe actions — a non-administrative user can invoke operations through the SDMP interface that execute with root privileges. As documented in NVISO's exploit analysis, the specific attack involves manipulating the naming or configuration of SDMP-monitored resources in a way that causes the privileged SDMP service to execute attacker-controlled operations. The Scope (Unchanged) metric indicates the impact is contained within the VM boundary, though root access within a VM could potentially be leveraged to attack the hypervisor or management plane depending on the broader environment configuration. The wide range of affected products (Aria Operations, Cloud Foundation, Telco Cloud Infrastructure and Platform, Open VM Tools, and even Debian packages) reflects the ubiquity of the vulnerable VMware Tools component across the VMware ecosystem.
Frequently Asked Questions
What is CVE-2025-41244?
CVE-2025-41244 is a local privilege escalation vulnerability in VMware Tools and VMware Aria Operations that allows a non-administrative user to gain root privileges on a virtual machine. The vulnerability specifically affects VMs that have VMware Tools installed and are managed by Aria Operations with the SDMP feature enabled.
Which VMware products are affected?
The vulnerability affects a broad range of VMware products including Aria Operations 8.x (prior to 8.18.5), VMware Cloud Foundation 4.x through 5.2.2, Open VM Tools 11.2.0 through 13.0.0, VMware Telco Cloud Infrastructure 2.2 through 3.0, and VMware Telco Cloud Platform 4.0 through 5.0. Debian Linux packages of Open VM Tools are also affected.
What is SDMP and how does it relate to this vulnerability?
SDMP (Service Discovery and Monitoring Protocol) is a feature in VMware Aria Operations that enables the monitoring and discovery of services running within managed virtual machines. It operates through VMware Tools installed in the guest OS. The vulnerability exists in how SDMP handles privileged operations, allowing non-administrative users to escalate their privileges through the SDMP service.
Is there a public exploit available?
Yes, NVISO has published a detailed technical blog post demonstrating the exploitation technique. The availability of this public exploit analysis means organizations should prioritize patching, as the technical barrier to exploitation has been significantly lowered.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.