Loading story…
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to urgently patch a high-severity local privilege escalation vulnerability, tracked as CVE-2025-41244, affecting Broadcom's VMware Aria Operations and VMware Tools. This flaw allows attackers with non-administrative access to a virtual machine, when managed by Aria Operations with SDMP enabled, to escalate privileges to root. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog after confirmation that it has been actively exploited in the wild, with exploitation attributed to the Chinese state-sponsored group UNC5174 since October 2024. Federal Civilian Executive Branch agencies have been given a three-week deadline to apply patches, and all organizations are strongly urged to prioritize remediation due to the significant risk posed by this vulnerability.
Broadcom patched CVE-2025-41244 one month prior to CISA's directive, and proof-of-concept code demonstrating exploitation has been publicly released. The vulnerability is considered a frequent attack vector for malicious cyber actors, and CISA's Binding Operational Directive 22-01 requires agencies to apply mitigations or discontinue use if patches are unavailable. While the directive is mandatory for federal agencies, CISA recommends that all organizations, regardless of sector, address the vulnerability immediately to prevent potential compromise of virtualized environments managed by VMware Tools and Aria Operations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Under Binding Operational Directive 22-01, CISA required U.S. federal civilian agencies to patch or otherwise remediate the newly added KEV vulnerabilities by November 20, 2025. CISA also urged private organizations to prioritize the fixes.
CISA added CVE-2025-41244 affecting Broadcom VMware Aria Operations and VMware Tools, along with XWiki Platform flaw CVE-2025-24893, to its Known Exploited Vulnerabilities catalog after confirming in-the-wild exploitation.
Broadcom addressed CVE-2025-41244 in a security update for affected VMware products, including VMware Tools and VMware Aria Operations. The update was released before CISA added the flaw to its Known Exploited Vulnerabilities catalog.
The China-linked threat actor UNC5174 began exploiting CVE-2025-41244, a local privilege escalation flaw in VMware Tools, as a zero-day in active attacks. Reporting indicates this exploitation had been occurring since October 2024.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcebleepingcomputer.com
Open sourcesecurityaffairs.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical local privilege escalation vulnerability, tracked as CVE-2025-41244, has been identified and exploited in the wild, affecting multiple VMware products including VMware Tools and VMware Aria Operations. The flaw allows a malicious local actor with non-administrative privileges on a virtual machine (VM) to escalate their privileges to root, provided VMware Tools is installed and managed by Aria Operations with the Service Discovery Management Pack (SDMP) enabled. The vulnerability impacts a wide range of VMware products, such as VMware Cloud Foundation (versions 4.x, 5.x, 9.x.x.x, and 13.x.x.x), VMware vSphere Foundation (9.x.x.x and 13.x.x.x), VMware Aria Operations 8.x, VMware Tools (11.x.x, 12.x.x, and 13.x.x), VMware Telco Cloud Platform (4.x and 5.x), and VMware Telco Cloud Infrastructure (2.x and 3.x). NVISO Labs discovered and reported the vulnerability during an incident response engagement on May 19, 2025, and observed that it had been exploited as a zero-day since at least mid-October 2024. The exploitation has been attributed to UNC5174, a China-linked threat actor also known as Uteus or Uetus, who has a history of leveraging vulnerabilities in enterprise software for initial access operations. The vulnerability resides in the get_version() function, which is part of the guest service discovery features in VMware Tools and Aria Operations. Successful exploitation enables unprivileged users to execute code in privileged contexts, such as root, on affected VMs. The attack requires prior access to the VM, as the vulnerability is local in nature, meaning it cannot be exploited remotely without an initial foothold. Broadcom, which now owns VMware, released an advisory on September 29, 2025, detailing the vulnerability and providing remediation guidance. VMware Tools 12.4.9, included in VMware Tools 12.5.4, addresses the issue for Windows 32-bit systems, and a patched version of open-vm-tools will be distributed by Linux vendors. Organizations using VMware Aria Suite, particularly those leveraging the Service Discovery Management Pack, are at heightened risk and should prioritize patching. The Aria Suite is widely used for managing hybrid-cloud workloads, and its service discovery features can operate in both credential-based and credential-less modes, both of which may be impacted. NVISO Labs could not definitively determine whether the exploit was developed by UNC5174 or opportunistically used due to its simplicity, but the group’s involvement is confirmed. The vulnerability’s exploitation underscores the ongoing targeting of virtualization and cloud management platforms by state-sponsored actors. Security teams are urged to review VMware’s advisory, apply patches promptly, and monitor for signs of compromise associated with UNC5174. The incident highlights the importance of timely vulnerability management and the risks posed by advanced persistent threat actors exploiting zero-day flaws in widely deployed enterprise infrastructure.
Jun 29, 2026
Broadcom has released a series of security updates addressing multiple high-severity vulnerabilities across several VMware products, including VMware Tools, Aria Operations, vCenter, and NSX. The patched vulnerabilities include privilege escalation and information disclosure flaws that could allow attackers to gain elevated access or extract sensitive data from affected systems. In VMware Tools and Aria Operations, three vulnerabilities (CVE-2025-41244, CVE-2025-41245, CVE-2025-41246) were disclosed, which can be exploited to escalate privileges to root, steal credentials, and access other guest virtual machines. A zero-day proof-of-concept for a privilege escalation flaw in VMware Tools was published, with reports indicating that Chinese APT groups have leveraged this vulnerability in attacks. Broadcom also addressed two high-severity vulnerabilities in VMware NSX, reported by the U.S. National Security Agency (NSA), which allow unauthenticated attackers to enumerate valid usernames, potentially facilitating brute-force or unauthorized access attempts. Additionally, a high-severity SMTP header injection vulnerability (CVE-2025-41250) in VMware vCenter was patched, which could be exploited by attackers with non-administrative privileges to manipulate notification emails for scheduled tasks. The vulnerabilities in NSX and vCenter highlight the risk of unauthorized access and lateral movement within virtualized environments. Broadcom acknowledged the NSA's role in reporting the NSX flaws and emphasized the importance of timely patching. The company has a recent history of addressing critical VMware vulnerabilities, including those exploited as zero-days during the Pwn2Own Berlin 2025 hacking contest and others reported by the Microsoft Threat Intelligence Center. State-sponsored threat actors and cybercriminal groups, including ransomware operators, are known to actively target VMware vulnerabilities, increasing the urgency for organizations to apply these patches. The coordinated disclosure and rapid patching efforts underscore the ongoing threat landscape facing virtualization infrastructure. Organizations using VMware products are strongly advised to review Broadcom's security advisories and implement the recommended updates to mitigate the risk of exploitation. The vulnerabilities affect both on-premises and cloud-based VMware deployments, making comprehensive patch management essential. Security teams should also monitor for signs of exploitation, especially in environments where patching may be delayed. The publication of proof-of-concept exploits and reports of active targeting by advanced persistent threat groups further elevate the risk profile of these vulnerabilities. Broadcom's advisories provide detailed mitigation steps and highlight the collaborative efforts between vendors and security agencies to protect critical infrastructure. The breadth of affected products demonstrates the need for holistic security strategies in virtualized and cloud environments. Failure to address these vulnerabilities could result in significant compromise of sensitive systems and data.
Jun 29, 2026
**CISA added CVE-2024-37079, a critical VMware vCenter Server vulnerability, to its Known Exploited Vulnerabilities (KEV) Catalog after Broadcom indicated it has evidence of in-the-wild exploitation.** The flaw is a **9.8 CVSS** out-of-bounds write/heap-overflow issue in vCenter Server’s **DCERPC** implementation; an attacker with network access can send specially crafted packets that may result in **remote code execution (RCE)**. CISA’s KEV entry does not attribute exploitation to a specific threat actor and lists ransomware use as **unknown**, but the KEV addition triggers mandatory remediation timelines for US federal agencies. Reporting also noted CISA added multiple other enterprise software issues to KEV in a short span (including vulnerabilities affecting **Versa Concerto** and **Zimbra**, plus developer tools), but the vCenter Server item drew specific attention because it was **patched by Broadcom in 2024** and is still being exploited. Broadcom has not publicly provided details on the scope, victims, or exploitation chain beyond acknowledging observed exploitation, reinforcing the need for organizations running vCenter Server to validate exposure and ensure the relevant updates are deployed.
Jun 29, 2026