VMware Tools and Aria 0-Day Under Active Exploitation for Privilege Escalation

Organizations using VMware hypervisors are facing an urgent threat as a local privilege escalation zero-day, tracked as CVE-2025-41244, is under active exploitation in the wild. The flaw affects both VMware Tools and VMware Aria Operations’ Service Discovery Management Pack (SDMP), enabling an unprivileged user to achieve root-level code execution without authentication.

According to NVISO’s analysis, the vulnerability has been weaponised by the UNC5174 threat group since mid-October 2024, heightening the risk to hybrid-cloud environments. The CVSS 3.1 score is 7.8, and the issue involves two modes of Aria Operations’ SDMP: credential-based and credential-less, with exploitation demonstrated via get-versions[.]sh patterns that can trigger execution of a malicious binary. Immediate patching to apply Broadcom’s advisory updates, along with enhanced monitoring and filesystem hardening, are recommended to mitigate the risk.