Skip to main content
cvebuzz

CVE mentions, exploit signals, and PoC evidence in one fast public view.

CVE detail

CVE-2025-41244

VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.

CVSS 7.8 · HighBuzz score 57.3KEV listed

Buzz score

Why this CVE is surfacing

Buzz score total 57.3

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 20.8 · diversity 11.5 · KEV 25.0 · OTX 0.0 · PoC 0.0
Mention score
20.8
7 evidence mentions in the snapshot
Diversity score
11.5
3 sources across 2 categories
KEV score
25.0
Known exploited vulnerability present
OTX score
0.0
0 OTX pulses
PoC score
0.0
0 repos · best confidence N/A
Best PoC traction
0
Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions
0
within the 30d window
Peak daily
0
highest bucket

Evidence

Source links by recency

Newest mentions first
7 source links · newest first
  • CISA Adds Exploited XWiki, VMware Flaws to KEV CatalogSecurityWeek

    Broadcom has updated its advisory on CVE-2025-41244 to mention the vulnerability’s in-the-wild exploitation.

    newswww.securityweek.comOct 31, 2025, 10:57 AM
  • U.S. CISA adds XWiki Platform, and Broadcom VMware Aria Operations and VMware Tools flaws to its Known Exploited Vulnerabilities catalogSecurity Affairs

    U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds XWiki Platform, and Broadcom VMware Aria Operations and VMware Tools flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added XWiki Platform, and Broadcom VMware Aria Operations and VMware Tools flaws to its Known Exploited Vulnerabilities (KEV) catalog. Below are the flaws […]

    newssecurityaffairs.comOct 30, 2025, 11:14 PM
  • 6th October – Threat Intelligence ReportCheck Point Research

    For the latest discoveries in cyber research for the week of 6th October, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Red Hat has confirmed a cyber attack that resulted in unauthorized access to one of its GitLab instances. The attackers, Crimson Collective, claim to have stolen approximately 570GB of compressed data. The […]

    vendorresearch.checkpoint.comOct 6, 2025, 9:44 AM
  • Security Affairs newsletter Round 544 by Pierluigi Paganini – INTERNATIONAL EDITIONSecurity Affairs

    A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. GreyNoise detects 500% surge in scans targeting Palo Alto Networks portals U.S. CISA adds Smartbedded Meteobridge, […]

    newssecurityaffairs.comOct 5, 2025, 11:35 AM
  • Broadcom Fails to Disclose Zero-Day Exploitation of VMware VulnerabilitySecurityWeek

    Impacting VMware Aria Operations and VMware Tools, the flaw can be exploited to elevate privileges on the VM.

    newswww.securityweek.comOct 1, 2025, 9:25 AM
  • Broadcom patches VMware Zero-Day actively exploited by UNC5174Security Affairs

    Broadcom patched six VMware flaws, including CVE-2025-41244, which has been exploited in the wild as a zero-day since mid-October 2024 by UNC5174 Broadcom addressed six VMware vulnerabilities, including four high-severity issues. One of these flaws, tracked as CVE-2025-41244 (CVSS score 7.8), allows local users to escalate to root via VMware Tools and Aria Operations. “VMware […]

    newssecurityaffairs.comSep 30, 2025, 2:06 PM
  • High-Severity Vulnerabilities Patched in VMware Aria Operations, NSX, vCenterSecurityWeek

    The flaws could allow attackers to escalate privileges, manipulate notifications, and enumerate usernames.

    newswww.securityweek.comSep 30, 2025, 11:33 AM

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

0 repository references · best confidence N/A · max 0 stars
No public PoC repositories have been matched yet.

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence