Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.
Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2025-11-20. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Priority
LOW
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
4 versions affected across 10 products
| Date | Total | Labels |
|---|
| 2026-02-07 | 1 | Disclosure1 |
| 2026-02-12 | 1 | General1 |
| 2026-04-13 | 1 | General1 |
| 2026-08-20 | 2 | General2 |
You name it, VMware elevates it (CVE-2025-41244) #CVE202541244 #VMware #PrivilegeEscalation #ZeroDay #ServiceDiscovery https://blog.nviso.eu/2025/09/29/you-name-it-vmware-elevates-it-cve-2025-41244/
Post summary
Tweet announces a new VMware zero‑day CVE‑2025‑41244 but offers no further details beyond a link.
LOOK BACK — VMware Tools shipped a discovery script that ran any listening binary matching /\S+/httpd as root, to read its version. /tmp/httpd matched. CVE-2025-41244 sat in open-vm-tools 5.5 years, and its finder can't say if the actor who tripped it meant to. https://t.co/AiEspdKDgN
Post summary
The tweet notes that a discovery script in VMware Tools flagged CVE‑2025‑41244 in open‑vm‑tools 5.5, but it gives no information on exploitation, patches, or a PoC.
@rxerium Im unable to DM directly. Its nuclei -t rxerium-templates/ -u https://host. I get [CVE-2025-41244] [http] [high] https://host/ui/login.action?vcf=1
Post summary
Nuclei scan output indicating detection of CVE-2025-41244 on https://host/ui/login.action?vcf=1, with no evidence of exploitation or mitigation.
Full Look Back: the 2020 commit that shipped the flaw, the 2020 hardening commit that edited the same line and missed it, and why Broadcom deleted the feature instead of fixing the regex. https://cvebrief.com/cve/CVE-2025-41244/ https://t.co/DYGKn6rZG1
Post summary
The tweet gives a brief recap of how CVE-2025-41244 was introduced and missed during a hardening commit, and explains why Broadcom chose to remove the feature instead of fixing the underlying regex.
Critical security advisory for #Fedora administrators: CVE-2025-41244 represents a local privilege escalation vulnerability in open-vm-tools with CISA Major Incident designation. Read more: 👉 https://tinyurl.com/bjtnhc9f #Security https://t.co/Mg7rk9zwPH
Post summary
The advisory alerts Fedora administrators of CVE‑2025‑41244, a local privilege escalation flaw in open‑vm‑tools, and notes a CISA Major Incident rating.
11 of 11 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | debian | debian_linux | 11.0 | - | - |
| OS | linux | linux_kernel | - | - | - |
| OS | microsoft | windows | - | - | - |
| App | vmware | aria_operations | - | - | - |
| App | vmware | cloud_foundation | - | - | - |
| App | vmware | cloud_foundation_operations | 9.0 | - | - |
| App | vmware | open_vm_tools | - | - | - |
| App | vmware | open_vm_tools | 13.0.0 | - | - |
| App | vmware | telco_cloud_infrastructure | - | - | - |
| App | vmware | telco_cloud_platform | - | - | - |
| App | vmware | tools | - | - | - |