CVE-2025-41244: Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability

Patch now

HIGH 7.8EXPLOITEDUPGRADEUPGRADEDOWNGRADE

CVE-2025-41244 is a high-severity flaw (CVSS 7.8) affecting aria operations, cloud foundation, cloud foundation operations, reported as exploited in the wild. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.

Why this priority

High severity
EPSS top 5%: very likely to be exploited
Exploited in the wild (CISA KEV)
Public exploit reference

A fixed release or distro patch exists.

Risk facts

CVSS score	7.8 (High)
Attack vector	Local
Attack complexity	Low
Privileges needed	Low
User interaction	None
EPSS exploit chance	8.6% (top 5%)
CISA exploited list	Yes, fix due 2025-11-20
Weakness	CWE-267
Published	2025-09-29
Last modified	2026-10-18

Publisher (CNA): VMware · Vendor: vmware

Last updated 2026-10-18 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2025-09-29 17:15 UTCPublished CVE record published
2025-10-30Exploited Added to the CISA Known Exploited Vulnerabilities list
2025-11-20Deadline CISA due date for US federal agencies to patch
2026-10-18 21:10 UTCUpdated Record last modified

vmware aria operations UPGRADE

Affected: >= 8.0 and < 8.18.5

Fixed in: 8.18.5

Safe to downgrade to: a release before 8.0

1. Check installed version

apt-cache policy aria-operations || rpm -q aria-operations || aria-operations --version

2. UPGRADE to 8.18.5 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade aria-operations

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade aria-operations

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 8.0 (Debian / Ubuntu)

apt-cache madison aria-operations sudo apt install aria-operations=<VERSION_BEFORE_8.0> sudo apt-mark hold aria-operations

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list aria-operations sudo dnf downgrade aria-operations-<VERSION_BEFORE_8.0> sudo dnf versionlock add aria-operations

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

vmware cloud foundation UPGRADE

Affected: >= 4.0 and <= 5.2.2

Fixed in: newer than 5.2.2

Safe to downgrade to: a release before 4.0

1. Check installed version

apt-cache policy cloud-foundation || rpm -q cloud-foundation || cloud-foundation --version

2. UPGRADE to newer than 5.2.2 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade cloud-foundation

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade cloud-foundation

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 4.0 (Debian / Ubuntu)

apt-cache madison cloud-foundation sudo apt install cloud-foundation=<VERSION_BEFORE_4.0> sudo apt-mark hold cloud-foundation

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list cloud-foundation sudo dnf downgrade cloud-foundation-<VERSION_BEFORE_4.0> sudo dnf versionlock add cloud-foundation

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

vmware cloud foundation operations DOWNGRADE

Affected: 9.0

Fixed in: no fixed release known

Safe to downgrade to: a release before 9.0

1. Check installed version

apt-cache policy cloud-foundation-operations || rpm -q cloud-foundation-operations || cloud-foundation-operations --version

2. No fixed release: DOWNGRADE to a release before 9.0 (Debian / Ubuntu)

apt-cache madison cloud-foundation-operations sudo apt install cloud-foundation-operations=<VERSION_BEFORE_9.0> sudo apt-mark hold cloud-foundation-operations

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list cloud-foundation-operations sudo dnf downgrade cloud-foundation-operations-<VERSION_BEFORE_9.0> sudo dnf versionlock add cloud-foundation-operations

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

vmware open vm tools UPGRADE

Affected: >= 11.2.0 and < 12.5.4 · 13.0.0

Fixed in: 12.5.4

Safe to downgrade to: a release before 11.2.0

1. Check installed version

apt-cache policy open-vm-tools || rpm -q open-vm-tools || open-vm-tools --version

2. UPGRADE to 12.5.4 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade open-vm-tools

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade open-vm-tools

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 11.2.0 (Debian / Ubuntu)

apt-cache madison open-vm-tools sudo apt install open-vm-tools=<VERSION_BEFORE_11.2.0> sudo apt-mark hold open-vm-tools

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list open-vm-tools sudo dnf downgrade open-vm-tools-<VERSION_BEFORE_11.2.0> sudo dnf versionlock add open-vm-tools

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

vmware telco cloud infrastructure UPGRADE

Affected: >= 2.2 and <= 3.0

Fixed in: newer than 3.0

Safe to downgrade to: a release before 2.2

1. Check installed version

apt-cache policy telco-cloud-infrastructure || rpm -q telco-cloud-infrastructure || telco-cloud-infrastructure --version

2. UPGRADE to newer than 3.0 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade telco-cloud-infrastructure

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade telco-cloud-infrastructure

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 2.2 (Debian / Ubuntu)

apt-cache madison telco-cloud-infrastructure sudo apt install telco-cloud-infrastructure=<VERSION_BEFORE_2.2> sudo apt-mark hold telco-cloud-infrastructure

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list telco-cloud-infrastructure sudo dnf downgrade telco-cloud-infrastructure-<VERSION_BEFORE_2.2> sudo dnf versionlock add telco-cloud-infrastructure

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

vmware telco cloud platform UPGRADE

Affected: >= 4.0 and < 5.0.1

Fixed in: 5.0.1

Safe to downgrade to: a release before 4.0

1. Check installed version

apt-cache policy telco-cloud-platform || rpm -q telco-cloud-platform || telco-cloud-platform --version

2. UPGRADE to 5.0.1 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade telco-cloud-platform

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade telco-cloud-platform

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 4.0 (Debian / Ubuntu)

apt-cache madison telco-cloud-platform sudo apt install telco-cloud-platform=<VERSION_BEFORE_4.0> sudo apt-mark hold telco-cloud-platform

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list telco-cloud-platform sudo dnf downgrade telco-cloud-platform-<VERSION_BEFORE_4.0> sudo dnf versionlock add telco-cloud-platform

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Exact fixes by distribution

A distro patch exists: prefer upgrading over downgrading.

Fedora 46 · wordpress · FIXED · 7.1.4-1.fc46 · FEDORA-2026-907394725e · source

sudo dnf upgrade --advisory=FEDORA-2026-907394725e

Fedora ELN · rhc · FIXED · 0.3.15-1.eln159 · FEDORA-2026-1cd9f35750 · source

sudo dnf upgrade --advisory=FEDORA-2026-1cd9f35750

Debian 12 · open-vm-tools · FIXED · 2:12.2.0-1+deb12u4

sudo apt update && sudo apt install --only-upgrade open-vm-tools dpkg --compare-versions "$(dpkg-query -W -f='${Version}' open-vm-tools)" ge "2:12.2.0-1+deb12u4" && echo PATCHED || echo STILL-VULNERABLE

Debian 13 · open-vm-tools · FIXED · 2:12.5.0-2+deb13u1

sudo apt update && sudo apt install --only-upgrade open-vm-tools dpkg --compare-versions "$(dpkg-query -W -f='${Version}' open-vm-tools)" ge "2:12.5.0-2+deb13u1" && echo PATCHED || echo STILL-VULNERABLE

RHEL 10 · open-vm-tools · FIXED · open-vm-tools-12.5.0-1.el10_0.1

sudo dnf upgrade --advisory=RHSA-2025:17429 rpm -q open-vm-tools

RHEL 8 · open-vm-tools · FIXED · open-vm-tools-12.3.5-2.el8_10.1

sudo dnf upgrade --advisory=RHSA-2025:17509 rpm -q open-vm-tools

RHEL 8.4 Advanced Mission Critical Update Support · open-vm-tools · FIXED · open-vm-tools-11.2.0-2.el8_4.5

sudo dnf upgrade --advisory=RHSA-2025:17512 rpm -q open-vm-tools

RHEL 8.4 Extended Update Support Long-Life Add-On · open-vm-tools · FIXED · open-vm-tools-11.2.0-2.el8_4.5

sudo dnf upgrade --advisory=RHSA-2025:17512 rpm -q open-vm-tools

RHEL 8.6 Advanced Mission Critical Update Support · open-vm-tools · FIXED · open-vm-tools-11.3.5-1.el8_6.6

sudo dnf upgrade --advisory=RHSA-2025:17511 rpm -q open-vm-tools

Amazon Linux 2023 · see advisory · FIXED · ALAS2023-2025-1226 · source

sudo dnf update --advisory=ALAS2023-2025-1226

Amazon Linux 2 · see advisory · FIXED · ALAS2-2025-3036 · source

sudo yum update --advisory=ALAS2-2025-3036

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

GitHub PoC: NULL200OK/CVE-2025-41244 (2 stars)
GitHub PoC: rxerium/CVE-2025-41244 (1 stars)
GitHub PoC: haspiranti/CVE-2025-41244-PoC (0 stars)
Write-up: blog.nviso.eu/2025/09/29/you-name-it-vmware-elevates-it-cve-2025-41244/

Verify at the official source NVD · CVE Program · CISA KEV catalog · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2025-41244?

aria operations: upgrade to 8.18.5; cloud foundation: upgrade to newer than 5.2.2; cloud foundation operations: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2025-41244 being exploited?

Yes. CVE-2025-41244 is on the CISA Known Exploited Vulnerabilities list, so treat it as patch-now.

What does CVE-2025-41244 affect?

CVE-2025-41244 affects aria operations, cloud foundation, cloud foundation operations. Severity is high (CVSS 7.8). VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDM

How urgent is CVE-2025-41244?

Priority 81/100. High severity; EPSS top 5%: very likely to be exploited; Exploited in the wild (CISA KEV); Public exploit reference

Software pages

VMware vulnerabilities

Related CVEs

CVE-2026-41723 HIGH 8.0 UPGRADE UPGRADE VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious a
CVE-2026-41722 HIGH 8.0 UPGRADE UPGRADE VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious a
CVE-2026-41724 HIGH 8.0 UPGRADE UPGRADE VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious a
CVE-2026-22721 MEDIUM 6.2 UPGRADE UPGRADE VMware Aria Operations contains a privilege escalation vulnerability
CVE-2026-22720 HIGH 8.0 UPGRADE UPGRADE VMware Aria Operations contains a stored cross-site scripting vulnerability

References

← Back to latest CVEs