7.8

CVE-2025-41244: Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability

CVSS: 7.8v3.1HighKEVAnalyzed
AliasesMGASA-2025-0237SUSE-RU-2026:20677-1SUSE-SU-2025:03434-1
Published 29-09-2025Last modified 26-02-2026
Open JSON

Vulnerability summary

CVE-2025-41244 is a high (CVSS 7.8) Privilege Defined With Unsafe Actions vulnerability in Broadcom VMware Aria Operations and VMware Tools. It is known to be exploited: CISA lists it, first on 30-10-2025. EPSS estimates a 8.63% chance of exploitation in the next 30 days, higher than 95% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
85/100
0100
Critical · default modelHow is this calculated?
CVSS score
7.8/10
010
High · v3.1 (CVE.org)
EPSS score
8.63%
0%100%
Low · +0.19 pp in 30 days
KEVListedCISA
RansomwareNone recordedNo known use recorded
Public exploits1reference

Timeline

  1. 29-09-2025
    PublishedVulnerability first disclosed.
  2. 30-10-2025
    Added to CISA KEVBroadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability
  3. 20-11-2025
    CISA remediation dueApply mitigations per vendor instructions.
  4. 26-02-2026
    Last modifiedVulnerability information updated.

Description

VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

8.63%

Chance of exploitation in the next 30 days

Percentile

95%

Versus all other CVEs

30-day change

+0.19 pp

From 8.44% on 19-09-2026

19-09-202619-10-2026
EPSS score
8.63%

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
30-10-2025
Federal due date
20-11-2025

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. support.broadcom.com/web/… nvd.nist.gov/vuln/detail/CVE-2025-41244

Public exploits

1 found
  • referenceUnverified

    Exploit Reference (blog.nviso.eu)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Suse32 products
  • open-vm-tools&distro=SUSE Enterprise Storage 7.1< 13.0.0-150300.64.1
  • open-vm-tools&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS< 13.0.0-150300.64.1
  • open-vm-tools&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 13.0.0-150300.64.1
  • open-vm-tools&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 13.0.0-150300.64.1
  • open-vm-tools&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS< 13.0.0-150300.64.1
Vmware13 products
Redhat10 products
  • open-vm-tools< 0:12.5.0-1.el9_6.2 | < 0:12.5.0-1.el10_0.1 | < 0:12.3.5-2.el9_4.1 | < 0:12.1.5-1.el9_2.5 | < 0:11.3.5-1.el9_0.6 | < 0:12.3.5-2.el8_10.1 | < 0:12.1.5-2.el8_8.5 | < 0:11.3.5-1.el8_6.6 | < 0:11.2.0-2.el8_4.5
  • open-vm-tools-debuginfo< 0:12.5.0-1.el9_6.2 | < 0:12.5.0-1.el10_0.1 | < 0:12.3.5-2.el9_4.1 | < 0:12.1.5-1.el9_2.5 | < 0:11.3.5-1.el9_0.6 | < 0:12.3.5-2.el8_10.1 | < 0:12.1.5-2.el8_8.5 | < 0:11.3.5-1.el8_6.6 | < 0:11.2.0-2.el8_4.5
  • open-vm-tools-debugsource< 0:12.5.0-1.el9_6.2 | < 0:12.5.0-1.el10_0.1 | < 0:12.3.5-2.el9_4.1 | < 0:12.1.5-1.el9_2.5 | < 0:11.3.5-1.el9_0.6 | < 0:12.3.5-2.el8_10.1 | < 0:12.1.5-2.el8_8.5 | < 0:11.3.5-1.el8_6.6 | < 0:11.2.0-2.el8_4.5
  • open-vm-tools-desktop< 0:12.5.0-1.el9_6.2 | < 0:12.5.0-1.el10_0.1 | < 0:12.3.5-2.el9_4.1 | < 0:12.1.5-1.el9_2.5 | < 0:11.3.5-1.el9_0.6 | < 0:12.3.5-2.el8_10.1 | < 0:12.1.5-2.el8_8.5 | < 0:11.3.5-1.el8_6.6 | < 0:11.2.0-2.el8_4.5
  • open-vm-tools-desktop-debuginfo< 0:12.5.0-1.el9_6.2 | < 0:12.5.0-1.el10_0.1 | < 0:12.3.5-2.el9_4.1 | < 0:12.1.5-1.el9_2.5 | < 0:11.3.5-1.el9_0.6 | < 0:12.3.5-2.el8_10.1 | < 0:12.1.5-2.el8_8.5 | < 0:11.3.5-1.el8_6.6 | < 0:11.2.0-2.el8_4.5
Opensuse3 products
  • open-vm-tools&distro=openSUSE Leap 15.6< 13.0.0-150600.3.18.1 | < 13.0.5-150600.3.21.1
  • open-vm-tools&distro=openSUSE Leap 16.0< 13.0.5-160000.1.1
  • open-vm-tools&distro=openSUSE Tumbleweed< 13.0.5-1.1
Debian2 products
  • open-vm-tools< 2:12.2.0-1+deb12u4 | < 2:12.5.0-2+deb13u1 | < 2:13.0.5-1 | < 2:11.2.5-2+deb11u5
  • debian_linuxEOL11.0
Mageia1 product
  • open-vm-tools< 12.3.5-2.2.mga9
Ubuntu1 product
  • open-vm-tools< 2:11.3.0-2ubuntu0~ubuntu20.04.8+esm1 | < 2:12.3.5-3~ubuntu0.22.04.3 | < 2:12.5.0-1~ubuntu0.24.04.2

7 vendors · 62 products

References

50 links
Show all 50 references