Broadcom patches VMware Zero-Day actively exploited by UNC5174

Broadcom has released patches for six VMware flaws, including the high-severity CVE-2025-41244, which has been exploited in the wild as a zero-day since mid-October 2024 by the China-linked threat actor UNC5174, according to Broadcom advisory notes. The vulnerability allows a malicious local actor with non-administrative privileges to escalate to root on a VM with VMware Tools installed and managed by Aria Operations, with a maximum CVSSv3 base score of 7.8.

Broadcom’s fixes cover VMware Aria Operations, Tools, Cloud, and Telco products, and also address two additional flaws: CVE-2025-41245 (information disclosure) and CVE-2025-41246 (improper authorisation). NVISO Labs’ report cited by the article states zero-day exploitation began in mid-October 2024 and that UNC5174 triggered the local privilege escalation, a group described as Chinese state-sponsored and linked to initial access operations.

The affected product versions include multiple VMware Cloud Foundation, vSphere Foundation, Aria Operations, Tools, Telco Cloud platforms, and related components.