VMware Aria and Tools Vulnerabilities Fixed Amid Ongoing Exploitation

Summary

In October 2025, Broadcom released urgent security patches for multiple VMware vulnerabilities impacting VMware Aria Operations, VMware Tools, VMware Cloud Foundation, VMware Telco Cloud Platform, and VMware Telco Cloud Infrastructure. The most critical flaw, CVE-2025-41244, is a zero-day privilege escalation vulnerability actively exploited by the threat actor UNC5174 (aka Uteus) to escalate privileges from a normal user to root access on guest VMs. Alongside this, CVE-2025-41245 (information disclosure) and CVE-2025-41246 (improper authorization) were also patched. With proof-of-concept exploits circulating and real-world attacks confirmed, organizations must patch immediately, restrict local VM access, and enforce tighter vCenter and ESX account controls to avoid full environment compromise.

Vulnerability Details

• CVE-2025-41244: Local privilege escalation flaw in VMware Aria Operations and VMware Tools. Attackers with local VM access can escalate to root if the environment uses SDMP. Actively exploited by UNC5174 since October 2024.

• CVE-2025-41245: Information disclosure vulnerability in VMware Aria Operations. Low-privileged users may expose other users’ credentials.

• CVE-2025-41246: Improper authorization vulnerability in VMware Tools for Windows. In scenarios where attackers already hold valid credentials and authenticated vCenter/ESX sessions, they can move laterally across guest VMs.

Technical Exploitation:
Attackers exploit CVE-2025-41244 by staging binaries in writable paths (e.g., /tmp/httpd), forcing them into the guest process tree with open listening sockets so VMware’s discovery picks them up. This tactic has been observed in active exploitation campaigns attributed to UNC5174.

Affected Versions:

• VMware Tools prior to 3.0.5.0, 13.0.5, 12.5.4

• VMware Aria Operations prior to 8.18.5 (also 5.x, 4.x)

• VMware Cloud Foundation Operations prior to 9.0.1.0

Recommendations

• Patch Immediately: Apply Broadcom’s latest security updates for VMware Aria Operations and VMware Tools to mitigate CVE-2025-41244, CVE-2025-41245, and CVE-2025-41246.

• Limit Local Access: Restrict local accounts on guest VMs. Fewer local users reduce attack surface.

• Monitor Unusual Activity: Look for unfamiliar binaries in writable paths like /tmp/ and suspicious listening sockets.

• Review User Permissions: Reduce unnecessary privileges in VMware Aria Operations to limit exposure from CVE-2025-41245.

• Vulnerability Management: Maintain a current inventory of versions and patches across VMware environments and vet third-party vendors’ patching practices.

MITRE ATT&CK TTPs

• TA0042 Resource Development – T1588 (Obtain Capabilities), T1588.006 (Vulnerabilities)

• TA0004 Privilege Escalation – T1068 (Exploitation for Privilege Escalation)

• TA0005 Defense Evasion – T1036 (Masquerading), T1036.005 (Match Legitimate Resource Name or Location)

• TA0006 Credential Access – T1552 (Unsecured Credentials)

References

• Broadcom Security Advisory

• NVISO Blog – CVE-2025-41244 Analysis

• MITRE ATT&CK Framework