Loading story…
VMware released security advisories addressing multiple vulnerabilities affecting several of its products, including VMware Aria Operations and VMware Tools. The vulnerabilities, identified as CVE-2025-41244, CVE-2025-41245, and CVE-2025-41246, were disclosed in advisory VMSA-2025-0015. One of the most critical issues, CVE-2025-41244, is a local privilege escalation vulnerability that allows a malicious local user with non-administrative privileges to escalate their access to root on a virtual machine. This exploit is possible when VMware Tools is installed and managed by Aria Operations with SDMP enabled. The vulnerability has been rated with a CVSS score of 7.8, indicating a high severity risk. Affected products include VMware Aria Operations versions 8.x, VMware Tools versions 13.x.x, 12.x.x, and 11.x.x, as well as VMware Cloud Foundation, VMware NSX, VMware NSX-T, VMware Telco Cloud Infrastructure, VMware Telco Cloud Platform, VMware vCenter, and VMware vSphere Foundation. The advisory details that versions of VMware Tools prior to 13.0.5.0 and 12.5.4, and Aria Operations prior to 8.18.5, are vulnerable. VMware Cloud Foundation and Telco Cloud products are also impacted if running affected versions. The Canadian Centre for Cyber Security issued an alert urging users and administrators to review the advisories and apply the recommended mitigations. The vulnerabilities could allow attackers to gain full control over affected virtual machines, posing significant risks to organizations relying on VMware infrastructure. VMware has released patches and updates to address these vulnerabilities, and organizations are strongly advised to update their systems promptly. The advisories also provide links to further technical details and mitigation steps. The vulnerabilities are not known to be exploited in the wild at the time of disclosure, but the ease of local exploitation increases the urgency for remediation. Administrators are encouraged to verify their product versions and ensure that all affected systems are updated to the latest secure releases. The advisories highlight the importance of maintaining up-to-date virtualization infrastructure to prevent privilege escalation attacks. Organizations using VMware in cloud, telco, and enterprise environments should prioritize patching to mitigate potential threats. The coordinated disclosure and rapid release of patches demonstrate VMware's commitment to security and the need for vigilance among its user base.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
On 2025-09-30, runZero published a blog post explaining how defenders can find VMware Aria installations on their networks, providing follow-on defensive guidance related to the advisory.
On 2025-09-30, the Center for Internet Security published an advisory highlighting that the VMware Aria Operations and VMware Tools flaws could allow privilege escalation.
On 2025-09-29, the vulnerabilities were reflected in CVE and downstream security advisories, including guidance from the Canadian Centre for Cyber Security urging administrators to review VMware advisories and apply mitigations.
On 2025-09-29, VMware released security advisory VMSA-2025-0015 addressing multiple vulnerabilities in VMware Aria Operations and VMware Tools, including CVE-2025-41244, CVE-2025-41245, and CVE-2025-41246.
6 references tracked. Mallory keeps watching after this page renders.
runzero.com
Open sourcecisecurity.org
Open sourcecyber.gc.ca
Open sourcecve.mitre.org
Open sourcesupport.broadcom.com
Open sourcesupport.broadcom.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical local privilege escalation vulnerability, tracked as CVE-2025-41244, has been identified and exploited in the wild, affecting multiple VMware products including VMware Tools and VMware Aria Operations. The flaw allows a malicious local actor with non-administrative privileges on a virtual machine (VM) to escalate their privileges to root, provided VMware Tools is installed and managed by Aria Operations with the Service Discovery Management Pack (SDMP) enabled. The vulnerability impacts a wide range of VMware products, such as VMware Cloud Foundation (versions 4.x, 5.x, 9.x.x.x, and 13.x.x.x), VMware vSphere Foundation (9.x.x.x and 13.x.x.x), VMware Aria Operations 8.x, VMware Tools (11.x.x, 12.x.x, and 13.x.x), VMware Telco Cloud Platform (4.x and 5.x), and VMware Telco Cloud Infrastructure (2.x and 3.x). NVISO Labs discovered and reported the vulnerability during an incident response engagement on May 19, 2025, and observed that it had been exploited as a zero-day since at least mid-October 2024. The exploitation has been attributed to UNC5174, a China-linked threat actor also known as Uteus or Uetus, who has a history of leveraging vulnerabilities in enterprise software for initial access operations. The vulnerability resides in the get_version() function, which is part of the guest service discovery features in VMware Tools and Aria Operations. Successful exploitation enables unprivileged users to execute code in privileged contexts, such as root, on affected VMs. The attack requires prior access to the VM, as the vulnerability is local in nature, meaning it cannot be exploited remotely without an initial foothold. Broadcom, which now owns VMware, released an advisory on September 29, 2025, detailing the vulnerability and providing remediation guidance. VMware Tools 12.4.9, included in VMware Tools 12.5.4, addresses the issue for Windows 32-bit systems, and a patched version of open-vm-tools will be distributed by Linux vendors. Organizations using VMware Aria Suite, particularly those leveraging the Service Discovery Management Pack, are at heightened risk and should prioritize patching. The Aria Suite is widely used for managing hybrid-cloud workloads, and its service discovery features can operate in both credential-based and credential-less modes, both of which may be impacted. NVISO Labs could not definitively determine whether the exploit was developed by UNC5174 or opportunistically used due to its simplicity, but the group’s involvement is confirmed. The vulnerability’s exploitation underscores the ongoing targeting of virtualization and cloud management platforms by state-sponsored actors. Security teams are urged to review VMware’s advisory, apply patches promptly, and monitor for signs of compromise associated with UNC5174. The incident highlights the importance of timely vulnerability management and the risks posed by advanced persistent threat actors exploiting zero-day flaws in widely deployed enterprise infrastructure.
Jun 29, 2026
Broadcom has released a series of security updates addressing multiple high-severity vulnerabilities across several VMware products, including VMware Tools, Aria Operations, vCenter, and NSX. The patched vulnerabilities include privilege escalation and information disclosure flaws that could allow attackers to gain elevated access or extract sensitive data from affected systems. In VMware Tools and Aria Operations, three vulnerabilities (CVE-2025-41244, CVE-2025-41245, CVE-2025-41246) were disclosed, which can be exploited to escalate privileges to root, steal credentials, and access other guest virtual machines. A zero-day proof-of-concept for a privilege escalation flaw in VMware Tools was published, with reports indicating that Chinese APT groups have leveraged this vulnerability in attacks. Broadcom also addressed two high-severity vulnerabilities in VMware NSX, reported by the U.S. National Security Agency (NSA), which allow unauthenticated attackers to enumerate valid usernames, potentially facilitating brute-force or unauthorized access attempts. Additionally, a high-severity SMTP header injection vulnerability (CVE-2025-41250) in VMware vCenter was patched, which could be exploited by attackers with non-administrative privileges to manipulate notification emails for scheduled tasks. The vulnerabilities in NSX and vCenter highlight the risk of unauthorized access and lateral movement within virtualized environments. Broadcom acknowledged the NSA's role in reporting the NSX flaws and emphasized the importance of timely patching. The company has a recent history of addressing critical VMware vulnerabilities, including those exploited as zero-days during the Pwn2Own Berlin 2025 hacking contest and others reported by the Microsoft Threat Intelligence Center. State-sponsored threat actors and cybercriminal groups, including ransomware operators, are known to actively target VMware vulnerabilities, increasing the urgency for organizations to apply these patches. The coordinated disclosure and rapid patching efforts underscore the ongoing threat landscape facing virtualization infrastructure. Organizations using VMware products are strongly advised to review Broadcom's security advisories and implement the recommended updates to mitigate the risk of exploitation. The vulnerabilities affect both on-premises and cloud-based VMware deployments, making comprehensive patch management essential. Security teams should also monitor for signs of exploitation, especially in environments where patching may be delayed. The publication of proof-of-concept exploits and reports of active targeting by advanced persistent threat groups further elevate the risk profile of these vulnerabilities. Broadcom's advisories provide detailed mitigation steps and highlight the collaborative efforts between vendors and security agencies to protect critical infrastructure. The breadth of affected products demonstrates the need for holistic security strategies in virtualized and cloud environments. Failure to address these vulnerabilities could result in significant compromise of sensitive systems and data.
Jun 29, 2026
VMware released security updates to fix multiple vulnerabilities across **VMware Aria Operations**, **VMware Cloud Foundation Operations**, **VMware Cloud Foundation**, **VMware vSphere Foundation**, and **VMware Telco Cloud Platform**. The most prominent issue, **`CVE-2026-41722`**, is a stored cross-site scripting flaw in VMware Cloud Foundation Operations with a **CVSS 8.0** rating that can be exploited over the network with low attack complexity, low privileges, and required user interaction. The update also remediates **`CVE-2026-41723`** and **`CVE-2026-41724`**, according to the advisory circulated by EG-FinCIRT and mirrored in multiple notices. Organizations using the affected VMware platforms were urged to test and deploy the patches promptly to reduce exposure across core virtualization and cloud management environments.
Jul 10, 2026