CVE-2025-41244
VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability.
- Severity
- 7.8 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 8.63%
- Chance of exploitation in the next 30 days. Higher than 95.10% of scored vulnerabilities.
- Known exploited
- Yes
- In CISA's catalog since Oct 30, 2025
- Weakness
- CWE-267 Privilege Defined With Unsafe Actions
- Fix
- None yet
- No fixed version published
Description
VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 3.1 7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-267: Privilege Defined With Unsafe Actions
A particular privilege, role, capability, or right can be used to perform unsafe actions that were not intended, even when it is assigned to the correct entity.
How to prevent it
- Architecture and Design, Operation: Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
- Architecture and Design, Operation: Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
References
Advisories
Exploits and evidence
Issue reports
Other links
Timeline
- Published
- Added to CISA's Known Exploited Vulnerabilities catalog
- Remediation due for U.S. federal agencies
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| DRUPAL-CONTRIB-2026-166 The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. | Medium | Same weakness, CWE-267 |
| DRUPAL-CONTRIB-2026-162 The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. | Medium | Same weakness, CWE-267 |
| DRUPAL-CONTRIB-2026-161 The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. | Low | Same weakness, CWE-267 |
| GHSA-p976-h52c-26p6 Rancher vulnerable to Privilege Escalation via manipulation of Secrets | High | Same weakness, CWE-267 |
| GHSA-m4mv-rmr7-h5f5 Pimcore Privilege Defined With Unsafe Actions vulnerability | High | Same weakness, CWE-267 |
| GHSA-7m27-3587-83xf Privilege Defined With Unsafe Actions in Keycloak | High | Same weakness, CWE-267 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor