CVE-2025-41244—Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability

漏洞名称

Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability

描述

Broadcom VMware Aria Operations and VMware Tools contain a privilege defined with unsafe actions vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.

已知用于勒索软件活动吗？

勒索软件状态：

Unknown

采集行动

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

其他说明

• https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36149
• https://nvd.nist.gov/vuln/detail/CVE-2025-41244

相关新闻文章

• CISA: VMware ESXi flaw now exploited in ransomware attacksFebruary 4, 2026
• CISA says critical VMware RCE flaw now actively exploitedJanuary 26, 2026
• CISA Flags VMware Zero-Day Exploited by China-Linked Hackers in Active AttacksOctober 31, 2025
• CISA orders feds to patch VMware Tools flaw exploited by Chinese hackersOctober 30, 2025

相关 CWE

• CWE-267