Read the docs
TI-2025-27491 Aliases CVE-2025-41244GHSA-76fp-m4vp-hxrq

VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple…

Priority CRITICAL 93Exploited in the wildCWE-267Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.

Why it matters now

Exploitation Active In CISA KEV since 2025-10-30CISA due date 2025-11-20
EPSS 0.15841 96th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed VCF operations (VMware): 9.0.1.0VMware tools (VMware): 13.0.5.0, 12.5.4+4 more productsRed Hat: 9 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
VMwareVCF operations9.0.x to before 9.0.1.09.0.1.0Patch availableCNA
VMwareVMware tools13.x.x.x to before 13.0.5.0; 12.5.x to before 12.5.413.0.5.0, 12.5.4Patch availableCNA
VMwareVMware Aria Operations8.18.x to before 8.18.58.18.5Patch availableCNA
VMwareVMware Cloud Foundation5.x to before 8.18.5; 4.x to before 8.18.58.18.5Patch availableCNA
VMwareVMware Telco Cloud Platform5.x to before 8.18.5; 4.x to before 8.18.58.18.5Patch availableCNA
VMwareVMware Telco Cloud Infrastructure3.x to before 8.18.5; 2.x to before 8.18.58.18.5Patch availableCNA
  • VCF operations VendorVMware Affected 9.0.x to before 9.0.1.0 Fixed in 9.0.1.0 Patch available CNA
  • VMware tools VendorVMware Affected 13.x.x.x to before 13.0.5.0; 12.5.x to before 12.5.4 Fixed in 13.0.5.0, 12.5.4 Patch available CNA
  • VMware Aria Operations VendorVMware Affected 8.18.x to before 8.18.5 Fixed in 8.18.5 Patch available CNA
  • VMware Cloud Foundation VendorVMware Affected 5.x to before 8.18.5; 4.x to before 8.18.5 Fixed in 8.18.5 Patch available CNA
  • VMware Telco Cloud Platform VendorVMware Affected 5.x to before 8.18.5; 4.x to before 8.18.5 Fixed in 8.18.5 Patch available CNA
  • VMware Telco Cloud Infrastructure VendorVMware Affected 3.x to before 8.18.5; 2.x to before 8.18.5 Fixed in 8.18.5 Patch available CNA

CPE configurations NVD · 11

CPEVersionsRoleVendor
cpe:2.3:a:vmware:aria_operations:*:*:*:*:*:*:*:*8.0 to before 8.18.5VulnerableVMware
cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*4.0 – 5.2.2VulnerableVMware
cpe:2.3:a:vmware:cloud_foundation_operations:9.0:*:*:*:*:*:*:*9.0VulnerableVMware
cpe:2.3:a:vmware:open_vm_tools:*:*:*:*:*:*:*:*11.2.0 to before 12.5.4VulnerableVMware
cpe:2.3:a:vmware:open_vm_tools:13.0.0:*:*:*:*:*:*:*13.0.0VulnerableVMware
cpe:2.3:a:vmware:telco_cloud_infrastructure:*:*:*:*:*:*:*:*2.2 – 3.0VulnerableVMware
cpe:2.3:a:vmware:telco_cloud_platform:*:*:*:*:*:*:*:*4.0 to before 5.0.1VulnerableVMware
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*11.0VulnerableDebian
cpe:2.3:a:vmware:tools:*:*:*:*:*:*:*:*12.5.0 to before 12.5.4; 13.0.0.0 to before 13.0.5.0VulnerableVMware
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*not specified by NVDRunning onLinux
  • cpe:2.3:a:vmware:aria_operations:*:*:*:*:*:*:*:* Versions 8.0 to before 8.18.5 Vulnerable ·VMware
  • cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:* Versions 4.0 – 5.2.2 Vulnerable ·VMware
  • cpe:2.3:a:vmware:cloud_foundation_operations:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·VMware
  • cpe:2.3:a:vmware:open_vm_tools:*:*:*:*:*:*:*:* Versions 11.2.0 to before 12.5.4 Vulnerable ·VMware
  • cpe:2.3:a:vmware:open_vm_tools:13.0.0:*:*:*:*:*:*:* Versions 13.0.0 Vulnerable ·VMware
  • cpe:2.3:a:vmware:telco_cloud_infrastructure:*:*:*:*:*:*:*:* Versions 2.2 – 3.0 Vulnerable ·VMware
  • cpe:2.3:a:vmware:telco_cloud_platform:*:*:*:*:*:*:*:* Versions 4.0 to before 5.0.1 Vulnerable ·VMware
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
  • cpe:2.3:a:vmware:tools:*:*:*:*:*:*:*:* Versions 12.5.0 to before 12.5.4; 13.0.0.0 to before 13.0.5.0 Vulnerable ·VMware
  • cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Linux
Show 1 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
  • cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

  • Fix · CNA VCF operations (VMware) Fixed in 9.0.1.0
  • Fix · CNA VMware tools (VMware) Fixed in 13.0.5.0, 12.5.4
  • Fix · CNA VMware Aria Operations (VMware) Fixed in 8.18.5
  • Fix · CNA VMware Cloud Foundation (VMware) Fixed in 8.18.5
  • Fix · CNA VMware Telco Cloud Platform (VMware) Fixed in 8.18.5
  • Fix · CNA VMware Telco Cloud Infrastructure (VMware) Fixed in 8.18.5

Red Hat 9 advisories

  • RHSA-2025:17509 Released 2025-10-07 · Red Hat rating Important
    open-vm-tools security update
    • Red Hat Enterprise Linux AppStream (v. 8) open-vm-tools-12.3.5-2.el8_10.1, open-vm-tools-desktop-12.3.5-2.el8_10.1, open-vm-tools-salt-minion-12.3.5-2.el8_10.1 +1
  • RHSA-2025:17511 Released 2025-10-07 · Red Hat rating Important
    open-vm-tools security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) open-vm-tools-11.3.5-1.el8_6.6, open-vm-tools-desktop-11.3.5-1.el8_6.6, open-vm-tools-sdmp-11.3.5-1.el8_6.6
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) open-vm-tools-11.3.5-1.el8_6.6, open-vm-tools-desktop-11.3.5-1.el8_6.6, open-vm-tools-sdmp-11.3.5-1.el8_6.6
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) open-vm-tools-11.3.5-1.el8_6.6, open-vm-tools-desktop-11.3.5-1.el8_6.6, open-vm-tools-sdmp-11.3.5-1.el8_6.6
  • RHSA-2025:17510 Released 2025-10-07 · Red Hat rating Important
    open-vm-tools security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) open-vm-tools-12.1.5-2.el8_8.5, open-vm-tools-desktop-12.1.5-2.el8_8.5, open-vm-tools-salt-minion-12.1.5-2.el8_8.5 +1
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) open-vm-tools-12.1.5-2.el8_8.5, open-vm-tools-desktop-12.1.5-2.el8_8.5, open-vm-tools-salt-minion-12.1.5-2.el8_8.5 +1
Show 6 more Red Hat advisories
  • RHSA-2025:17512 Released 2025-10-07 · Red Hat rating Important
    open-vm-tools security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) open-vm-tools-11.2.0-2.el8_4.5, open-vm-tools-desktop-11.2.0-2.el8_4.5, open-vm-tools-sdmp-11.2.0-2.el8_4.5
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) open-vm-tools-11.2.0-2.el8_4.5, open-vm-tools-desktop-11.2.0-2.el8_4.5, open-vm-tools-sdmp-11.2.0-2.el8_4.5
  • RHSA-2025:17452 Released 2025-10-07 · Red Hat rating Important
    open-vm-tools security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) open-vm-tools-11.3.5-1.el9_0.6, open-vm-tools-desktop-11.3.5-1.el9_0.6, open-vm-tools-sdmp-11.3.5-1.el9_0.6 +1
  • RHSA-2025:17445 Released 2025-10-07 · Red Hat rating Important
    open-vm-tools security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) open-vm-tools-12.3.5-2.el9_4.1, open-vm-tools-desktop-12.3.5-2.el9_4.1, open-vm-tools-salt-minion-12.3.5-2.el9_4.1 +2
  • RHSA-2025:17446 Released 2025-10-07 · Red Hat rating Important
    open-vm-tools security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) open-vm-tools-12.1.5-1.el9_2.5, open-vm-tools-desktop-12.1.5-1.el9_2.5, open-vm-tools-salt-minion-12.1.5-1.el9_2.5 +2
  • RHSA-2025:17428 Released 2025-10-07 · Red Hat rating Important
    open-vm-tools security update
    • Red Hat Enterprise Linux AppStream (v. 9) open-vm-tools-12.5.0-1.el9_6.2, open-vm-tools-desktop-12.5.0-1.el9_6.2, open-vm-tools-salt-minion-12.5.0-1.el9_6.2 +2
  • RHSA-2025:17429 Released 2025-10-07 · Red Hat rating Important
    open-vm-tools security update
    • Red Hat Enterprise Linux AppStream (v. 10) open-vm-tools-12.5.0-1.el10_0.1, open-vm-tools-desktop-12.5.0-1.el10_0.1, open-vm-tools-salt-minion-12.5.0-1.el10_0.1 +2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    VMware Aria Operations, VMware Cloud Foundation and 2 more products 8.18.5

    2 records Highest priority Priority CRITICAL 1 CRITICAL, 1 LOW

    Other records, highest priority first

    • TI-2025-27492 VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple…Priority LOW 23
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2025:17429
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2025:17509
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2025:17428
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2025:17512
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2025:17511
Red Hat Enterprise Linux AppStream E4S (v.8.6)Fixed RHSA-2025:17511
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2025:17510
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2025:17452
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2025:17446
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2025:17445
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2025:17512
Red Hat Enterprise Linux AppStream TUS (v.8.6)Fixed RHSA-2025:17511
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2025:17510
Not affected: 2 products
  • Red Hat Enterprise Linux 7
  • Red Hat OpenShift Container Platform 4

Timeline

  1. 2025-10-30 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2025-41244
  3. 2026-10-03 Alias added: GHSA-76fp-m4vp-hxrq
  4. 2026-10-19 EPSS moved to the 95th–99th percentile

References

Exploit 1

Advisory 3

Other 1

  • TI-2026-18246 VMware Aria Operations command injection vulnerability KEVCVSS 3.1HIGH 8.1
  • TI-2026-18247 VMware Aria Operations stored cross-site scripting vulnerability CVSS 3.1CRITICAL 9.0
  • TI-2026-30239 Cross-site scripting in VMware VCF operations CVSS 3.1HIGH 8.0
  • TI-2026-30238 Cross-site scripting in VMware VCF operations CVSS 3.1HIGH 8.0
  • TI-2026-30237 Cross-site scripting in VMware VCF operations CVSS 3.1HIGH 8.0
  • TI-2024-26058 Local privilege escalation vulnerability (CVE-2024-38831) CVSS 3.1HIGH 7.8
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences