Log in Start free

Actively exploited · Published Sep 29, 2025 · Assigned by vmware

CVE-2025-41244VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246)

High 7.8 Exploited

In plain English

A high-severity security flaw in VCF operations from VMware. Attackers are actively exploiting it in the wild (listed by CISA on October 30, 2025). The chance it is exploited in the next 30 days is estimated at 8.6% (higher than 95% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)8.6%top 4.9% of all CVEs
Exploited in the wildYesCISA KEV since Oct 30, 2025
Attack tooling1Public PoC

CISA guidance

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Federal agencies must remediate by Nov 20, 2025.

Official description

VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10open-vm-tools12.5.0-1.el10_0.1ALSA-2025:17429
AlmaLinux:8open-vm-tools12.3.5-2.el8_10.1ALSA-2025:17509
AlmaLinux:9open-vm-tools12.5.0-1.el9_6.2ALSA-2025:17428
AlmaLinux:10open-vm-tools-desktop12.5.0-1.el10_0.1ALSA-2025:17429
AlmaLinux:8open-vm-tools-desktop12.3.5-2.el8_10.1ALSA-2025:17509
AlmaLinux:9open-vm-tools-desktop12.5.0-1.el9_6.2ALSA-2025:17428
AlmaLinux:10open-vm-tools-salt-minion12.5.0-1.el10_0.1ALSA-2025:17429
AlmaLinux:8open-vm-tools-salt-minion12.3.5-2.el8_10.1ALSA-2025:17509
AlmaLinux:9open-vm-tools-salt-minion12.5.0-1.el9_6.2ALSA-2025:17428
AlmaLinux:10open-vm-tools-sdmp12.5.0-1.el10_0.1ALSA-2025:17429
AlmaLinux:8open-vm-tools-sdmp12.3.5-2.el8_10.1ALSA-2025:17509
AlmaLinux:9open-vm-tools-sdmp12.5.0-1.el9_6.2ALSA-2025:17428
AlmaLinux:10open-vm-tools-test12.5.0-1.el10_0.1ALSA-2025:17429
AlmaLinux:9open-vm-tools-test12.5.0-1.el9_6.2ALSA-2025:17428
Debian:12open-vm-tools2:12.2.0-1+deb12u4DEBIAN-CVE-2025-41244
Debian:13open-vm-tools2:12.5.0-2+deb13u1DEBIAN-CVE-2025-41244
Debian:14open-vm-tools2:13.0.5-1DEBIAN-CVE-2025-41244
Rocky Linux:10open-vm-tools0:12.5.0-1.el10_0.1RLSA-2025:17429
Rocky Linux:8open-vm-tools0:12.3.5-2.el8_10.1RLSA-2025:17509
Rocky Linux:9open-vm-tools0:12.5.0-1.el9_6.2RLSA-2025:17428
Ubuntu:22.04:LTSopen-vm-tools2:12.3.5-3~ubuntu0.22.04.3USN-7785-1
Ubuntu:22.04:LTSopen-vm-tools2:12.3.5-3~ubuntu0.22.04.3UBUNTU-CVE-2025-41244
Ubuntu:24.04:LTSopen-vm-tools2:12.5.0-1~ubuntu0.24.04.2USN-7785-1
Ubuntu:24.04:LTSopen-vm-tools2:12.5.0-1~ubuntu0.24.04.2UBUNTU-CVE-2025-41244

Affected products (as reported)

VendorProductVersions
VMware VCF operations 9.0.x – before 9.0.1.0
VMware VMware tools 13.x.x.x – before 13.0.5.012.5.x – before 12.5.4
VMware VMware Aria Operations 8.18.x – before 8.18.5
VMware VMware Cloud Foundation 5.x – before 8.18.54.x – before 8.18.5
VMware VMware Telco Cloud Platform 5.x – before 8.18.54.x – before 8.18.5
VMware VMware Telco Cloud Infrastructure 3.x – before 8.18.52.x – before 8.18.5

Weakness: CWE-267 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References