Search/CVE-2025-41244
● CVE — High

CVE-2025-41244

Vendordebian, vmwareProductdebian linux, tools, cloud foundation, open-vm-tools, aria operations, telco cloud platform, telco cloud infrastructure, cloud foundation operationsDiscoveredSep 29, 2025UpdatedNov 6, 2025

VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.

View graph Watch Export
CVSS v3.1
7.8 HIGH
EPSS
8.63%
probability of exploitation in 30 days
CISA KEV
Listed
confirmed active exploitation
News coverage
2
sources referencing this CVE
Related IOCs
0
seen in the same coverage
EPSS Trend
Aug 16, 2026 → Oct 22, 2026
▲ 0.75pp
7.88% → 8.63% over 4 tracked changes
CVSS v3.1 Detail
Attack VectorLOCAL
Attack ComplexityLOW
Privileges RequiredLOW
User InteractionNONE
ScopeUNCHANGED
ConfidentialityHIGH
IntegrityHIGH
AvailabilityHIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Connections
11 relationships
Timeline
disclosure → media coverage
Sep 29, 2025
Disclosure — published as a CVE record. · last revised by NVD Nov 6, 2025
Oct 31, 2025
thehackernews.com reports: CISA Flags VMware Zero-Day Exploited by China-Linked Hackers in Active Attacks
Oct 31, 2025
securityweek.com reports: CISA Adds Exploited XWiki, VMware Flaws to KEV Catalog
Public PoC (3)
github.com/rxerium/CVE-2025-41244github.com/haspiranti/CVE-2025-41244-PoCgithub.com/NULL200OK/CVE-2025-41244
Unverified third-party code — review before executing.