DaystoPatch

Broadcom (VMware)Exploited incident

VMware Tools and Aria Operations local privilege escalation (VMSA-2025-0015)

CVE-2025-41244High, CVSS 7.8In CISA's Known Exploited Vulnerabilities catalog since 30 Oct 2025

  • Exploited before a fix
FixedFixed for every supported version on the day it became public.

Response

Silence
same day
First public report to first vendor statement
Exposure
same day
First public report to first fix
Follow-through
same day
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    date only

    NVISO Labs blog (Maxime Thiebaut, September 29, 2025)CuratedQuote verified

    NVISO has identified zero-day exploitation in the wild beginning mid-October 2024.

    Published the same day as Broadcom's advisory; NVISO attributes the exploitation to UNC5174. The post opens 'On September 29th, 2025, Broadcom disclosed a local privilege escalation vulnerability, CVE-2025-41244' (split by inline markup, so not quoted).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:af0a0f0162095b72…
    Used in metrics
    Yes
    Dispute this timestamp
    5 more sources for this moment
    Broadcom VMSA-2025-0015 (Wayback snapshot 2025-09-29)CuratedQuote verified29 Sep 2025

    Multiple vulnerabilities in VMware Aria Operations and VMware Tools were privately reported to Broadcom. Patches are available to remediate these vulnerabilities in affected Broadcom products.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:b2d11af7beab6317…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2025-41244ClaimedQuote verified29 Sep 2025, 16:09 UTC

    VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:3737bc11fa32dfbe…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet29 Sep 2025, 17:42 UTC

    [Security Advisory] open-vm-tools: Local privilege escalation (CVE-2025-41244)

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet30 Sep 2025, 15:20 UTC

    A tiny flaw in VMware has granted state-sponsored hackers root access worldwide—how did an overlooked vulnerability turn into a global security nightmare? https:// thedefendopsdiaries.com/cve-20

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2025-41244)ClaimedQuote verified30 Oct 2025

    Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability

    Added to CISA's KEV catalog on 2025-10-30.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    date onlysame day

    Broadcom VMSA-2025-0015 (Wayback snapshot 2025-09-29)CuratedQuote verified

    2025-09-29 VMSA-2025-0015

    Change log line '2025-09-29 VMSA-2025-0015 Initial security advisory.'; Issue date 2025-09-29.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:b2d11af7beab6317…
    Used in metrics
    Yes
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    date onlysame day

    Broadcom VMSA-2025-0015 (Wayback snapshot 2025-09-29)CuratedQuote verified

    To remediate CVE-2025-41244 apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' found below.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:b2d11af7beab6317…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    date onlysame day

    Broadcom VMSA-2025-0015 (Wayback snapshot 2025-09-29)CuratedQuote verified

    A version of open-vm-tools that addresses CVE-2025-41244 will be distributed by Linux vendors.

    Broadcom's own lines were all fixed at publication (VMware Tools 13.0.5 and 12.5.4, Aria Operations 8.18.5, VCF Operations 9.0.1.0, VCF 4.x/5.x via KB92148). The open-vm-tools fix depends on each Linux distribution's packaging, which we did not track.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:b2d11af7beab6317…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • VMware Tools 11.x, 12.x, 13.x (Windows, Linux)
  • open-vm-tools
  • VMware Aria Operations 8.x
  • VMware Cloud Foundation Operations 9.x
  • VMware Cloud Foundation
  • VMware Telco Cloud Platform / Infrastructure
How we built this timeline

exploited before a fix=true under R4: NVISO reports exploitation from mid-October 2024, before the 29 Sep 2025 fix (disclosed together with the fix), so world = vendor = First fix. Broadcom added the note 'Broadcom has information to suggest that suspected exploitation of CVE-2025-41244 has occurred in the wild.' in VMSA-2025-0015.1 on 30 Oct 2025 (the KEV listing date).

Exploitation requires a local non-admin user on a VM with VMware Tools managed by Aria Operations with SDMP enabled (or the open-vm-tools credential-less discovery path). Reported by Maxime Thiebaut (NVISO).

VMSA-2025-0015 also covers CVE-2025-41245/41246 (not in KEV).

Related

Broadcom (VMware) report card