Intel

CVE-2025-41244

Broadcom VMware Aria Operations and VMware Tools — Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability

criticalKEV: actively exploitedPoCEPSS 8.4%

Description

VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.

Source: BSI_CSAFBSIBSI_CSAFBSICISA_KEVNVDCVEORGREDHAT_CSAFREDHAT_CSAFREDHAT_CSAFREDHAT_CSAFREDHAT_CSAFREDHAT_CSAFREDHAT_CSAFREDHAT_CSAFREDHAT_CSAFCVELISTV5VMWARE_VMSA

Response & Mitigation

Why act now?

Prioritisation rationale

CVE-2025-41244 carries a CVSS score of 7.8 (AV:L/AC:L/PR:L/UI:N) and sits at the 94.6th EPSS percentile, signalling a very high probability of exploitation relative to the broader CVE population. The attack complexity is low: an adversary needs only a non-privileged local account on a guest VM — a realistic starting position in virtualised environments via a compromised application account or insider threat. The full C:H/I:H/A:H impact triad means a successful exploit yields complete control of the affected VM. CISA has not set the known-ransomware-campaign flag, but root-level access on a guest VM is a well-established stepping stone in lateral movement and ransomware deployment chains within virtualised infrastructure. Organisations running VMware Cloud Foundation or Telco Cloud Infrastructure should treat their exposure as elevated, as these platforms typically consolidate high-value workloads and represent a high-impact blast radius if compromised.

Runbook · Step 1

Immediate response (0-24 h)

  • Apply vendor patch: Check the Broadcom Security Advisory for CVE-2025-41244 and deploy available patches for VMware Aria Operations (affected: 8.0–8.18.5) and VMware Tools / open-vm-tools (affected: 11.2.0–12.5.4) immediately. Verify exact patch versions at broadcom.com/support/security-center.
  • Disable SDMP: As an emergency compensating control, disable the Service Discovery Management Pack (SDMP) in Aria Operations — the vulnerability is only exploitable when SDMP is enabled, so disabling it removes the attack path entirely until patching is complete.
  • Build an affected-VM inventory: Enumerate all VMs with VMware Tools installed that are managed by Aria Operations with SDMP enabled. Prioritise by criticality: KRITIS/OT systems, domain controllers, database servers.
  • Audit local accounts on affected VMs: List all non-administrative local accounts on affected VMs; lock unknown or suspicious accounts and rotate credentials immediately.
  • Include VMware Cloud Foundation (4.0–5.2.2) and Telco Cloud Infrastructure/Platform: These product lines are in scope — verify patch status across all components in the stack.
  • Update Debian packages: On Debian hosts running open-vm-tools, update via the distribution package manager: apt-get update && apt-get upgrade open-vm-tools.

Runbook · Step 2

Mitigation layers

  • SDMP disable as primary compensating control: Until patching is complete, disable SDMP in the Aria Operations console under Administration → Solutions → VMware SDMP. This fully closes the documented attack path.
  • Least-privilege on guest VMs: Reduce local user accounts on affected VMs to the minimum required. Disable interactive logins for service accounts; audit sudo rules and remove unnecessary entries.
  • Network segmentation: Restrict Aria Operations management traffic (typically port 443/TCP for SDMP communication) to dedicated management VLANs. Workload VMs must not have direct access to Aria Operations management interfaces.
  • Endpoint hardening: Enable and enforce SELinux or AppArmor profiles on Linux guest VMs to constrain privilege-escalation paths through unsafe actions triggered by the VMware Tools service.
  • Privileged-process monitoring: Configure EDR agents on all affected VMs to alert immediately when a process spawned by vmtoolsd runs as root without a preceding sudo/su invocation.
  • Restrict Aria Operations console access: Limit administrative access to Aria Operations to MFA-protected bastion hosts; avoid direct exposure of the management interface to production networks.

Runbook · Step 3

Detection rules

  • auditd — privilege escalation via vmtoolsd: Monitor execve syscalls where the parent process is vmtoolsd, the calling uid != 0, and the effective euid = 0. Sigma shape: process.parent.name: vmtoolsd AND user.id != "0" AND process.uid_effective: "0".
  • Sysmon (Linux) / EDR — unexpected root child processes: Process-tree anomaly: vmtoolsd spawning a child with euid=0 without a preceding sudo or su call. KQL snippet: process.parent.executable: "*vmtoolsd*" AND process.user.name: "root" AND NOT process.name: ("vmtoolsd" OR "vmware-*").
  • Linux /var/log/auth.log — session opened without authentication: Entries matching session opened for user root by <non-root-user> with no preceding authentication event within a 5-second window — indicative of privilege escalation bypassing the normal auth path.
  • Aria Operations audit log: Monitor for unexpected SDMP configuration changes or elevated API calls in Aria Operations audit logs (Administration → Audit); set alerts on SDMP_CONFIG_CHANGE events.
  • Network telemetry (Zeek/Suricata): Flag unexpected outbound connections from guest VMs to Aria Operations management IPs on non-standard ports (other than 443/TCP) as anomalies — a potential indicator of post-exploitation callback activity.

Metrics

Severity
critical
Priority score
208.74
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
7.8
Source: nvd-v3
CVSS v3
7.8
CVSS v4
—
EPSS percentile
94.7 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
8.4 %
Moderate — model estimates 1-10% exploitation likelihood.
Published
2025-10-30 00:00 UTC
CWE
CWE-267

Weakness classes (CWE)

  • CWE-267Base

    Privilege Defined With Unsafe Actions

    A particular privilege, role, capability, or right can be used to perform unsafe actions that were not intended, even when it is assigned to the correct entity.

    cwe.mitre.org →

Affected operating systems

  • linux

    debian / debian_linux11.0

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • vmware

    aria_operations8.0 – 8.18.5

  • vmware

    cloud_foundation4.0 – 5.2.2

  • vmware

    cloud_foundation_operations

  • vmware

    open_vm_tools11.2.0 – 12.5.4

  • vmware

    open_vm_tools

  • vmware

    telco_cloud_infrastructure2.2 – 3.0

  • vmware

    telco_cloud_platform4.0 – 5.0.1

  • vmware

    tools12.5.0 – 12.5.4

  • vmware

    tools13.0.0.0 – 13.0.5.0

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

IDCVE-2025-41244