Broadcom Fails to Disclose Zero-Day Exploitation of VMware Vulnerability

According to SecurityWeek, Broadcom rolled out patches for a newly disclosed high-severity VMware vulnerability that has been exploited as a zero-day since October 2024, tracked as CVE-2025-41244 (CVSS 7.8) and affecting VMware Aria Operations and VMware Tools. The flaw allows privilege escalation to root on VMs with VMware Tools installed and managed by Aria Operations with SDMP enabled, though Broadcom did not indicate in-the-wild exploitation in its advisories.

NVISO Labs, credited for discovering the issue, says a Chinese state-sponsored threat actor tracked as UNC5174 has been exploiting the bug for a year. NVISO notes that it is unclear whether the exploit is part of UNC5174’s capabilities or a coincidence of the vulnerability’s simplicity.

The discovery also highlights that open-vm-tools, used in major Linux distributions, is impacted, and Broadcom has issued fixes across VMware Cloud Foundation, vSphere Foundation, Aria Operations, Telco Cloud Platform, and VMware Tools, with open-vm-tools updates to be distributed by Linux vendors.