CISA Flags VMware Zero-Day Exploited by China-Linked Hackers in Active Attacks
Following indications of active exploitation in the wild, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a high-severity security weakness affecting VMware Aria Operations and Broadcom VMware Tools to its Known Exploited Vulnerabilities (KEV) list on Thursday.
CVE-2025-41244 (CVSS score: 7.8) is the vulnerability in question, which an attacker might use to get root level privileges on a vulnerable system.
According to a CISA alert, there is a privilege defined with dangerous actions vulnerability in Broadcom VMware Aria Operations and VMware Tools. This vulnerability allows a malevolent local actor with non-administrative credentials to get root access to a virtual machine (VM) that has VMware Tools installed and is managed by Aria Operations with SDMP enable...