Vulnerability · Published Sep 29, 2025 · Assigned by vmware
CVE-2025-41245VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246)
Medium 4.9
In plain English
A medium-severity security flaw in VMware Aria Operations from VMware. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).
Severity (CVSS 3.1)4.9Medium
Exploit odds (30 days)0.6%top 50.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
VMware Aria Operations contains an information disclosure vulnerability. A malicious actor with non-administrative privileges in Aria Operations may exploit this vulnerability to disclose credentials of other users of Aria Operations.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| VMware | VMware Aria Operations | 8.18.x – before 8.18.5 |
| VMware | VMware Cloud Foundation | 5.x – before 8.18.54.x – before 8.18.5 |
| VMware | VMware Telco Cloud Platform | 5.x – before 8.18.54.x – before 8.18.5 |
| VMware | VMware Telco Cloud Infrastructure | 3.x – before 8.18.52.x – before 8.18.5 |
Weakness: CWE-1188 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N