CISA Alerts on Active Exploitation of VMware Tools and Aria Operations 0-Day

According to CISA, there is active exploitation of a critical privilege escalation vulnerability affecting Broadcom’s VMware Tools and VMware Aria Operations, tracked as CVE-2025-41244. The 0‑day flaw could let a malicious actor with local, standard user access elevate to root privileges on the same virtual machine, bypassing common security controls in multi‑tenant and enterprise environments.

CISA’s urgent alert notes that threat actors are already leveraging this flaw in real‑world attacks, with low exploitation complexity and minimal prerequisites. A mandatory patching deadline has been set for 20 November 2025, and federal agencies are required to follow binding directive BOD 22‑01, with strong recommendations for critical infrastructure operators, especially those managing cloud services.

Broadcom has issued security guidance and patches are expected to address the unsafe actions within the privilege system; until then, mitigations include restricting local VM access, disabling SDMP where feasible, or discontinuing VMware Aria Operations use if needed. Security teams should prioritise asset discovery and patching timelines ahead of the November deadline.