CVE-2025-41245: medium-severity vulnerability in VMware Aria Operations
VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246)
Published · Updated
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.9epss 0.6%
exploitation probability
0.6%top 53% of all CVEs
observed exploitation
nono source reports it
VMware Aria Operations contains an information disclosure vulnerability. A malicious actor with non-administrative privileges in Aria Operations may exploit this vulnerability to disclose credentials of other users of Aria Operations.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Affected products
VMware · VMware Aria OperationsVMware · VMware Cloud FoundationVMware · VMware Telco Cloud InfrastructureVMware · VMware Telco Cloud PlatformRelated CVEs — VMware Aria Operations
In the same product, most dangerous first.
CVE-2026-22719HIGHVMware Aria Operations command injection vulnerabilityEPSS 17.7%KEVCVE-2025-41244HIGHVMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246)EPSS 8.4%KEVCVE-2025-22224CRITICALCVE-2025-22224EPSS 1.6%KEVCVE-2026-22721MEDIUMVMware Aria Operations privilege escalation vulnerabilityEPSS 0.7%CVE-2025-22222HIGHVMware Aria Operations information disclosure vulnerability (CVE-2025-22222)EPSS 0.6%CVE-2024-38832HIGHStored cross-site scripting vulnerability (CVE-2024-38832)EPSS 0.4%