CVE-2025-41244: high-severity vulnerability in VMware Aria Operations
VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246)
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
A flaw in VMware Tools allows a regular user on a virtual machine to gain root-level control if VMware Aria Operations is managing the system with SDMP enabled. This is dangerous because it lets unauthorized users take full control of the machine.
Local privilege escalation in VMware Tools affecting VMs managed by Aria Operations with SDMP (Secure Desktop Managed Peripherals or related management feature) enabled. An attacker with non-administrative local access can exploit this vulnerability to achieve root-level code execution on the compromised VM. Requires user to have local system access and the victim system to be under Aria Operations management.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.