China Exploited New VMware Bug for Nearly a Year

A newly disclosed VMware vulnerability has potentially been exploited by threat actors for nearly a year, with Broadcom on 29 September revealing three flaws: CVE-2025-41244, CVE-2025-41245 and CVE-2025-41246, affecting VMware Aria Operations and VMware Tools. NVISO, which analysed open-vm-tools, said exploitation of CVE-2025-41244 began in mid-October last year, a claim corroborated by its incident-response work and a published blog.

The firm noted that Chinese state-sponsored threat actor UNC5174 triggered the relevant local privilege escalation during attacks, raising concerns that other malware strains have benefited from the same unintended privilege escalations for years. NVISO described the CVE-2025-41244 execution as "trivial", and said several detection mechanisms should have triggered, given this local privilege-escalation pattern. Broadcom’s advisory states patches are available and customers should update to the latest versions, as no other workarounds or mitigations are provided.