Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability

Broadcom VMware Aria Operations and VMware Tools

Broadcom VMware Aria Operations and VMware Tools contain a privilege defined with unsafe actions vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM. Added to CISA KEV on 2025-10-30 (federal deadline 2025-11-20).

First seen: 30 Oct 2025
Last update: 30 Oct 2025, 12:00 UTC
Identifiers: CVE-2025-41244
Source: CISA KEV
On the menu as: VMware

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability
Severity: high, exploited in the wild. Patch status: patched.
Affected: Broadcom VMware Aria Operations and VMware Tools
Ids: CVE-2025-41244

Broadcom VMware Aria Operations and VMware Tools contain a privilege defined with unsafe actions vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM. Added to CISA KEV on 2025-10-30 (federal deadline 2025-11-20).

## Steps
1. This touches infrastructure (vmware). Look in terraform, ansible, cloud-init, Dockerfiles and docs for the product and version we run. If it isn't in the repo, say so and list what a human should check on the box.

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2025-41244") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://nvd.nist.gov/vuln/detail/CVE-2025-41244 https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36149
https://pwned.coffee/i/broadcom-vmware-aria-operations-and-vmware-tools-privile-cve-2025-41244

Sources

Totalone hot coffee