CISA Flags VMware Zero-Day Exploited by China-Linked Hackers in Active Attacks

According to CISA, a high-severity vulnerability in Broadcom VMware Tools and VMware Aria Operations, CVE-2025-41244 (CVSS 7.8), has been added to the Known Exploited Vulnerabilities (KEV) catalogue after reports of active exploitation in the wild. The flaw could allow a malicious local actor with non-administrative privileges on a VM with VMware Tools and Aria Operations SDMP enabled to escalate to root on the same VM.

The vulnerability was addressed by Broadcom-owned VMware last month, but had been exploited as a zero-day by unknown actors since mid-October 2024, according to NVISO Labs, which also noted its discovery during an incident response engagement in May. The activity is attributed to UNC5174, a China-linked threat actor tracked by Google Mandiant, who NVISO described as finding the flaw trivial to exploit, with details of the exact payload still withheld. Federal Civilian Executive Branch agencies are required to apply mitigations by 20 November 2025 to secure their networks against active threats.