High-Severity Vulnerabilities Patched in VMware Aria Operations, NSX, vCenter

According to Broadcom, six vulnerabilities affecting VMware Aria Operations, NSX, vCenter and VMware Tools were patched, including four high-severity flaws. The most serious is a local privilege escalation bug in both Aria Operations and VMware Tools tracked as CVE-2025-41244, which a malicious local actor with non-administrative privileges could exploit to escalate to root on the same VM with VMware Tools installed and SDMP enabled.

A medium-severity issue in VMware Aria Operations could disclose other users’ credentials (CVE-2025-41245), and a high-severity defect in Tools for Windows could allow attackers to access other guest VMs (CVE-2025-41246).

Fixes were included in Aria Operations version 8.18.5, Cloud Foundation and vSphere Foundation versions 9.0.1.0 and 13.0.5.0, VMware Tools versions 13.0.5 and 12.5.4, and Telco Cloud Infrastructure 8.18.5, with additional patches for vCenter’s high-severity SMTP header injection (CVE-2025-41250) and two NSX flaws enabling username enumeration (CVE-2025-41251 and CVE-2025-41252).

VMware also published patch instructions for Cloud Foundation and Telco Cloud Infrastructure, and notes that no exploitation in the wild was mentioned, with a strong advisory to update deployments promptly. 30 September 2025