Loading story…
A critical local privilege escalation vulnerability, tracked as CVE-2025-41244, has been identified and exploited in the wild, affecting multiple VMware products including VMware Tools and VMware Aria Operations. The flaw allows a malicious local actor with non-administrative privileges on a virtual machine (VM) to escalate their privileges to root, provided VMware Tools is installed and managed by Aria Operations with the Service Discovery Management Pack (SDMP) enabled. The vulnerability impacts a wide range of VMware products, such as VMware Cloud Foundation (versions 4.x, 5.x, 9.x.x.x, and 13.x.x.x), VMware vSphere Foundation (9.x.x.x and 13.x.x.x), VMware Aria Operations 8.x, VMware Tools (11.x.x, 12.x.x, and 13.x.x), VMware Telco Cloud Platform (4.x and 5.x), and VMware Telco Cloud Infrastructure (2.x and 3.x). NVISO Labs discovered and reported the vulnerability during an incident response engagement on May 19, 2025, and observed that it had been exploited as a zero-day since at least mid-October 2024. The exploitation has been attributed to UNC5174, a China-linked threat actor also known as Uteus or Uetus, who has a history of leveraging vulnerabilities in enterprise software for initial access operations. The vulnerability resides in the get_version() function, which is part of the guest service discovery features in VMware Tools and Aria Operations. Successful exploitation enables unprivileged users to execute code in privileged contexts, such as root, on affected VMs. The attack requires prior access to the VM, as the vulnerability is local in nature, meaning it cannot be exploited remotely without an initial foothold. Broadcom, which now owns VMware, released an advisory on September 29, 2025, detailing the vulnerability and providing remediation guidance. VMware Tools 12.4.9, included in VMware Tools 12.5.4, addresses the issue for Windows 32-bit systems, and a patched version of open-vm-tools will be distributed by Linux vendors. Organizations using VMware Aria Suite, particularly those leveraging the Service Discovery Management Pack, are at heightened risk and should prioritize patching. The Aria Suite is widely used for managing hybrid-cloud workloads, and its service discovery features can operate in both credential-based and credential-less modes, both of which may be impacted. NVISO Labs could not definitively determine whether the exploit was developed by UNC5174 or opportunistically used due to its simplicity, but the group’s involvement is confirmed. The vulnerability’s exploitation underscores the ongoing targeting of virtualization and cloud management platforms by state-sponsored actors. Security teams are urged to review VMware’s advisory, apply patches promptly, and monitor for signs of compromise associated with UNC5174. The incident highlights the importance of timely vulnerability management and the risks posed by advanced persistent threat actors exploiting zero-day flaws in widely deployed enterprise infrastructure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
NVISO released a detailed analysis of the vulnerability, explaining how overly broad regular expressions in open-vm-tools could cause privileged execution of attacker-controlled binaries from writable paths such as /tmp. The publication included a proof-of-concept exploit and detection guidance based on suspicious child processes and temporary-directory artifacts.
On September 29, 2025, Broadcom disclosed CVE-2025-41244 and released fixes for affected VMware products, including VMware Tools and VMware Aria Operations. Broadcom also patched related vulnerabilities CVE-2025-41245 and CVE-2025-41246 the same day.
During an incident response engagement in May 2025, NVISO identified the privilege escalation issue in VMware guest service discovery functionality and linked its triggering to UNC5174 activity. The finding led to responsible disclosure to Broadcom.
NVISO observed evidence that the China-nexus threat actor UNC5174 was exploiting what became CVE-2025-41244 starting in mid-October 2024. The flaw enabled local attackers to escalate privileges to root on affected Linux virtual machines.
7 references tracked. Mallory keeps watching after this page renders.
thecyberthrone.in
Open sourcedarkreading.com
Open sourcethehackernews.com
Open sourcesecurityaffairs.com
Open sourcebleepingcomputer.com
Open sourceblog.nviso.eu
Open sourcecybersecuritydive.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
VMware released security advisories addressing multiple vulnerabilities affecting several of its products, including VMware Aria Operations and VMware Tools. The vulnerabilities, identified as CVE-2025-41244, CVE-2025-41245, and CVE-2025-41246, were disclosed in advisory VMSA-2025-0015. One of the most critical issues, CVE-2025-41244, is a local privilege escalation vulnerability that allows a malicious local user with non-administrative privileges to escalate their access to root on a virtual machine. This exploit is possible when VMware Tools is installed and managed by Aria Operations with SDMP enabled. The vulnerability has been rated with a CVSS score of 7.8, indicating a high severity risk. Affected products include VMware Aria Operations versions 8.x, VMware Tools versions 13.x.x, 12.x.x, and 11.x.x, as well as VMware Cloud Foundation, VMware NSX, VMware NSX-T, VMware Telco Cloud Infrastructure, VMware Telco Cloud Platform, VMware vCenter, and VMware vSphere Foundation. The advisory details that versions of VMware Tools prior to 13.0.5.0 and 12.5.4, and Aria Operations prior to 8.18.5, are vulnerable. VMware Cloud Foundation and Telco Cloud products are also impacted if running affected versions. The Canadian Centre for Cyber Security issued an alert urging users and administrators to review the advisories and apply the recommended mitigations. The vulnerabilities could allow attackers to gain full control over affected virtual machines, posing significant risks to organizations relying on VMware infrastructure. VMware has released patches and updates to address these vulnerabilities, and organizations are strongly advised to update their systems promptly. The advisories also provide links to further technical details and mitigation steps. The vulnerabilities are not known to be exploited in the wild at the time of disclosure, but the ease of local exploitation increases the urgency for remediation. Administrators are encouraged to verify their product versions and ensure that all affected systems are updated to the latest secure releases. The advisories highlight the importance of maintaining up-to-date virtualization infrastructure to prevent privilege escalation attacks. Organizations using VMware in cloud, telco, and enterprise environments should prioritize patching to mitigate potential threats. The coordinated disclosure and rapid release of patches demonstrate VMware's commitment to security and the need for vigilance among its user base.
Jun 29, 2026
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to urgently patch a high-severity local privilege escalation vulnerability, tracked as CVE-2025-41244, affecting Broadcom's VMware Aria Operations and VMware Tools. This flaw allows attackers with non-administrative access to a virtual machine, when managed by Aria Operations with SDMP enabled, to escalate privileges to root. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog after confirmation that it has been actively exploited in the wild, with exploitation attributed to the Chinese state-sponsored group UNC5174 since October 2024. Federal Civilian Executive Branch agencies have been given a three-week deadline to apply patches, and all organizations are strongly urged to prioritize remediation due to the significant risk posed by this vulnerability. Broadcom patched CVE-2025-41244 one month prior to CISA's directive, and proof-of-concept code demonstrating exploitation has been publicly released. The vulnerability is considered a frequent attack vector for malicious cyber actors, and CISA's Binding Operational Directive 22-01 requires agencies to apply mitigations or discontinue use if patches are unavailable. While the directive is mandatory for federal agencies, CISA recommends that all organizations, regardless of sector, address the vulnerability immediately to prevent potential compromise of virtualized environments managed by VMware Tools and Aria Operations.
Jun 29, 2026
Broadcom has released a series of security updates addressing multiple high-severity vulnerabilities across several VMware products, including VMware Tools, Aria Operations, vCenter, and NSX. The patched vulnerabilities include privilege escalation and information disclosure flaws that could allow attackers to gain elevated access or extract sensitive data from affected systems. In VMware Tools and Aria Operations, three vulnerabilities (CVE-2025-41244, CVE-2025-41245, CVE-2025-41246) were disclosed, which can be exploited to escalate privileges to root, steal credentials, and access other guest virtual machines. A zero-day proof-of-concept for a privilege escalation flaw in VMware Tools was published, with reports indicating that Chinese APT groups have leveraged this vulnerability in attacks. Broadcom also addressed two high-severity vulnerabilities in VMware NSX, reported by the U.S. National Security Agency (NSA), which allow unauthenticated attackers to enumerate valid usernames, potentially facilitating brute-force or unauthorized access attempts. Additionally, a high-severity SMTP header injection vulnerability (CVE-2025-41250) in VMware vCenter was patched, which could be exploited by attackers with non-administrative privileges to manipulate notification emails for scheduled tasks. The vulnerabilities in NSX and vCenter highlight the risk of unauthorized access and lateral movement within virtualized environments. Broadcom acknowledged the NSA's role in reporting the NSX flaws and emphasized the importance of timely patching. The company has a recent history of addressing critical VMware vulnerabilities, including those exploited as zero-days during the Pwn2Own Berlin 2025 hacking contest and others reported by the Microsoft Threat Intelligence Center. State-sponsored threat actors and cybercriminal groups, including ransomware operators, are known to actively target VMware vulnerabilities, increasing the urgency for organizations to apply these patches. The coordinated disclosure and rapid patching efforts underscore the ongoing threat landscape facing virtualization infrastructure. Organizations using VMware products are strongly advised to review Broadcom's security advisories and implement the recommended updates to mitigate the risk of exploitation. The vulnerabilities affect both on-premises and cloud-based VMware deployments, making comprehensive patch management essential. Security teams should also monitor for signs of exploitation, especially in environments where patching may be delayed. The publication of proof-of-concept exploits and reports of active targeting by advanced persistent threat groups further elevate the risk profile of these vulnerabilities. Broadcom's advisories provide detailed mitigation steps and highlight the collaborative efforts between vendors and security agencies to protect critical infrastructure. The breadth of affected products demonstrates the need for holistic security strategies in virtualized and cloud environments. Failure to address these vulnerabilities could result in significant compromise of sensitive systems and data.
Jun 29, 2026